Vulnerability in Bevy Events And Groups
CVE-2025-54599
The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (33.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bevy.com/b/events-and-groups (Product)
- www.youtube.com/watch (Exploit)
- gist.github.com/deep1chil/558e8da919690a634bec684e7c4d0ffe (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-54599?
- CVE-2025-54599 is a high-severity vulnerability in Bevy Events And Groups, classified under Improper Access Control. CVSS score: 7.5/10. Published 2025-09-02.
- How severe is CVE-2025-54599?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-54599 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.