CVE-2025-54598

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI...

CVE-2025-54598: Cross-Site Request Forgery (CSRF)

The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via the /notifications/delete/ URI...

CVE-2025-54598

The Bevy Event service (versions through 2025-07-22 ), used for eBay Seller Events and other activities, is vulnerable to a Cross-Site Request Forgery (CSRF) attack. An attacker can exploit this flaw to delete all notifications by targeting the /notifications/delete/ API endpoint. To mitigate thi...