CVE-2025-15115 is a medium severity authentication bypass (CVSS 6.5) in the Petlibro Smart Pet Feeder Platform up to version 1.7.31. Weak social login validation lets an unauthenticated person obtain a session for another user's account. I could not confirm a vendor fix, so contact Petlibro and limit what the account holds.
What's affected
The record says Petlibro Smart Pet Feeder Platform versions up to 1.7.31 are affected. The weak point is the third party (social) login endpoint, where the platform does not properly verify the identity token it is given.
VulCheck, which published the advisory the CVE draws on, rates the flaw medium and dates it 5 January 2026. Neither the advisory nor the record names a fixed version. The vendor's own bulletin was not among the pages I could fetch, so check Petlibro's site and app store notes for an update.
How to check if you're exposed
For consumers, the checks are simple and mostly about the app:
- Open the Petlibro app and look at the app version and update history.
- Review the account for devices, feeding schedules and linked camera or location details you do not recognize.
- Check the sign-in method. Accounts created with Google sign-in are the ones the advisory describes.
For anyone who builds or integrates with a similar mobile backend, the check is in your own code: confirm that the server validates the signature and audience of every identity token and never trusts an ID sent by the client alone.
What to do now
- Update the Petlibro app and the feeder firmware as soon as the vendor releases a fix, and read their release notes.
- Ask Petlibro support directly whether CVE-2025-15115 is fixed and in which version.
- Review the account for activity you did not make, and remove information you do not want exposed.
- Consider using a distinct email and password sign-in if the vendor offers it, and enable any extra verification available.
- If you build apps with social login, add a server side check of the token's signature, issuer, audience and expiry.
Why it matters
The weakness is CWE-862, Missing Authorization. The record describes a social login flow that accepts a client supplied identifier without proving the person holds the matching account. Whoever controls the check on the server decides the account, so a client that can choose the identifier can choose the victim.
This is a recurring pattern in connected devices: the mobile app is polite, but the API behind it trusts too much. The CVSS vector is network based with no privileges, with low confidentiality and integrity impact (6.5). The record does not mark the CVE as known exploited in CISA's catalog, and the advisory does not say it is being exploited.
Quick check
Do I need to do anything if I use a different sign-in method?
The advisory describes the social login flow. Still watch for the vendor's update and review your account activity.
Can the device owner fix this?
Not fully. The weakness is in the vendor's service, so the fix has to come from Petlibro. Owners can limit exposure and keep software up to date.
Sources
Last reviewed: 19 October 2026.
