CVE-2025-54599

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-546017.0An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor amd Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 CVE-2025-546027.0An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480 CVE-2025-546039.0An incorrect OIDC authentication flow in Claroty Secure Access 3.3.0 through 4.0.2 can result in unauthorized user creation or impersonation CVE-2025-546047.5Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 1 of 2).CVE-2025-546057.5Bitcoin Core through 29.0 allows Uncontrolled Resource Consumption (issue 2 of 2).CVE-2025-546067.1Status verification vulnerability in the lock screen module. Impact: Successful exploitation of this vulnerability will affect availability CVE-2025-546077.5Authentication management vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect service confi CVE-2025-546084.0Vulnerability that allows setting screen rotation direction without permission verification in the screen management module. Impact: Success CVE-2025-546097.5Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-546107.5Out-of-bounds access vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-546115.5EXTRA_REFERRER resource read vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service c CVE-2025-546123.3Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may affect function stab