CVE-2025-54598

Name of the Vulnerable Software and Affected Versions: The Bevy Event service versions through 2025-07-22

Description: The Bevy Event service, used for eBay Seller Events and other activities, is susceptible to a Cross-Site Request Forgery (CSRF) issue. This flaw allows an attacker to delete all notifications by exploiting the /notifications/delete/ API endpoint.

Recommendations: Versions through 2025-07-22: Mitigate the issue by implementing CSRF protection mechanisms, such as synchronizer tokens, to validate requests originating from trusted sources.