CVE-2025-54599

CVSS 7.5 HIGHEPSS 0.4%CWE-284

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

02 sep 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Productos afectados

n/a · n/a

Referencias

https://bevy.com/b/events-and-groups https://gist.github.com/deep1chil/558e8da919690a634bec684e7c4d0ffe https://www.youtube.com/watch?v=wbmIvA09Ra8