CVE-2025-3660: Petlibro Smart Pet Feeder Platform broken access control in API

CVE-2025-3660 · Severity: medium · CVSS 6.5 · Published 2026-01-04

Petlibro's smart pet feeder platform, used to manage automated feeding and monitoring devices, contains a security flaw that allows unauthorized access to user data. An attacker can exploit this to view private information about other people's pets, including health data, photos, and owner account details. In more severe cases, this could lead to full account takeover, allowing unauthorized individuals to control feeding schedules or access home camera feeds.

Technologies: Petlibro, Petlibro Smart Pet Feeder Platform. Vendors: Petlibro.

Quick answers

Is CVE-2025-3660 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-3660 being exploited in the wild.
How severe is CVE-2025-3660?
Medium severity, with a CVSS score of 6.5, published 4 January 2026.
Which products and versions are affected?
Petlibro Smart Pet Feeder Platform up to 1.7.31.
Is there a fix for CVE-2025-3660?
A patch was published on 2025-12-04: Vendor claimed majority of issues resolved in latest app version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-3660 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-3660?
Check whether you run Petlibro or Petlibro Smart Pet Feeder Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability exists in the Petlibro Smart Pet Feeder Platform API endpoint /member/pet/detailV2. The application fails to perform ownership verification, allowing any authenticated user to query the details of any pet by providing an arbitrary pet ID. Successful exploitation grants access to sensitive data including pet names, breeds, birth dates, weights, appetite/activity levels, and associated member IDs. Related research indicates this flaw is part of a broader set of issues including an authentication bypass in /member/auth/thirdLogin and lack of authorization checks on device serial numbers, which could lead to full device hijacking and access to private audio/video feeds. While some fixes have been implemented, legacy endpoints may remain active.

Affected products

  • Petlibro Smart Pet Feeder Platform up to 1.7.31

Timeline

  • 2025-11-05: disclosed: Initial report to vendor by security researcher.
  • 2025-12-04: patched: Vendor claimed majority of issues resolved in latest app version.
  • 2026-01-03: advisory: CVE published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.