Bevy

bevy

2 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-54599 1Bevy 1Events And Groups Sep 10, 2025 Sep 2, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this,...Show more The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.Show less
CVE-2025-54598 1Bevy 1Bevy Sep 9, 2025 Aug 27, 2025 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2025-54599

1Bevy

1Events And Groups

Sep 10, 2025

Sep 2, 2025

N/A· v4

7.5 HIGH· v3

N/A· v2

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.Show less

CVE-2025-54598

1Bevy

Sep 9, 2025

Aug 27, 2025

N/A· v4

6.5 MEDIUM· v3

N/A· v2

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI.