Is CVE-2025-15115 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-15115 being exploited in the wild.

How severe is CVE-2025-15115?

Medium severity, with a CVSS score of 6.5, published 4 January 2026.

Which products and versions are affected?

Petlibro Smart Pet Feeder Platform up to 1.7.31.

Is there a fix for CVE-2025-15115?

A patch was published on 2025-12-04: Vendor claimed majority of issues resolved but kept vulnerable endpoint for legacy support. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-15115 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-15115?

Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-15115: Petlibro Smart Pet Feeder Platform authentication bypass in social login API

CVE-2025-15115 · Severity: medium · CVSS 6.5 · Published 2026-01-04

Petlibro smart pet feeders and fountains, used by millions of pet owners to manage feeding and monitoring remotely, are affected by a critical security flaw. An attacker can bypass security checks to log into any user account, allowing them to hijack devices, view camera feeds, listen to private audio recordings, and change feeding schedules. This could lead to unauthorized access to a user's home environment and potential harm to pets if feeding schedules are maliciously altered.

Technologies: Petlibro, Petlibro Smart Pet Feeder Platform. Vendors: Petlibro.

Quick answers

Is CVE-2025-15115 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-15115 being exploited in the wild.
How severe is CVE-2025-15115?: Medium severity, with a CVSS score of 6.5, published 4 January 2026.
Which products and versions are affected?: Petlibro Smart Pet Feeder Platform up to 1.7.31.
Is there a fix for CVE-2025-15115?: A patch was published on 2025-12-04: Vendor claimed majority of issues resolved but kept vulnerable endpoint for legacy support. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-15115 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-15115?: Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass exists in the Petlibro API endpoint `/member/auth/thirdLogin` due to a failure to verify OAuth tokens server-side. The application incorrectly treats a user's Google ID (which is public information) as a secret credential. An unauthenticated attacker can provide an arbitrary Google ID and `phoneBrand` parameter to the vulnerable endpoint to receive a valid session token for the targeted account. While a fix was developed, the vendor reportedly left the vulnerable legacy endpoint active to maintain compatibility with older app versions, leaving accounts exposed. Successful exploitation allows full account takeover, including access to pet data, device serial numbers, camera feeds, and private audio recordings.

Affected products

Petlibro Smart Pet Feeder Platform up to 1.7.31

Timeline

2025-11-05: disclosed: Initial report to vendor by security researcher.
2025-12-04: patched: Vendor claimed majority of issues resolved but kept vulnerable endpoint for legacy support.
2026-01-03: advisory: CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.