CVE-2025-54599: Bevy Event service · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Organizations should immediately audit their SSO configurations, particularly focusing on the processes that handle email address changes post-authentication. Implement strict validation and verification steps when users update critical identity attributes such as email addresses, including multi-factor authentication (MFA) challenges or out-of-band confirmation. It is crucial to ensure that the identity provider (IdP) and service provider (SP) maintain consistent and secure attribute mappings to prevent unauthorized account linkage. Monitoring and alerting should be enhanced to detect unusual account changes or login patterns indicative of takeover attempts. Where possible, temporarily disable email address changes via SSO until a patch or configuration fix is applied. Engage with the Bevy Event service provider or platform vendor to obtain patches or configuration guidelines addressing this vulnerability. Additionally, educate users about the risks of account changes and encourage strong authentication practices. Finally, conduct penetration testing focused on SSO flows to identify and remediate similar misconfigurations proactively.
Description
The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows account takeover, if SSO is used, when a victim changes the email address that they have configured. To exploit this, an attacker would create their own account and perform an SSO login. The root cause of the issue is SSO misconfiguration.