PT-2025-33825 · Bevy · Events/Groups

Ali Alhassoun · Published 2025-08-19 · Updated 2025-09-07 · CVE-2025-54599

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Bevy Event service versions through 2025-07-22

Description The Bevy Event service, used for eBay Seller Events and other activities, is susceptible to account takeover when Single Sign-On (SSO) is enabled and a victim modifies their configured email address. An attacker can create a new account and perform an SSO login to exploit this issue. The root cause is an SSO misconfiguration.

Recommendations Versions through 2025-07-22: Review and correct the SSO configuration to prevent account takeover when email addresses are changed.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-54599

Affected Products

Events/Groups

References · 8

• 🔥 https://gist.github.com/deep1chil/558e8da919690a634bec684e7c4d0ffe · Exploit
• 🔥 https://youtube.com/watch?v=wbmIvA09Ra8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54599 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54599 · Vendor Advisory
• https://twitter.com/cracbot/status/1964644882347147661 · Twitter Post
• https://twitter.com/CVEnew/status/1962906319364755912 · Twitter Post
• https://twitter.com/deepvvm/status/1957837389239406611 · Twitter Post
• https://bevy.com/b/events-and-groups · Note