Vulnerability in Bevy Events And Groups
CVE-2025-54599
The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.
EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Bevy Events_and_groups
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit)
- cve@mitre.org (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-54599?
- CVE-2025-54599 is a high-severity vulnerability in Bevy Events And Groups, classified under Improper Access Control. CVSS score: 7.5/10. Published 2025-09-02.
- How severe is CVE-2025-54599?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-54599 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.