A critical account takeover vulnerability in the Bevy Event service allows unauthorized access to user accounts via SSO misconfiguration.

The vulnerability is caused by an SSO misconfiguration that occurs during the email address update process. An unauthenticated attacker can exploit this by creating their own account and performing an SSO login to hijack a victim's session or account.

This vulnerability poses a significant risk to user data and platform integrity. Successful exploitation leads to full account takeover, which may result in unauthorized access to sensitive user information, potential financial fraud, and severe reputational damage. With a CVSS score of 7.5, the risk is classified as High due to the potential for unauthorized access to user accounts without requiring prior authentication.

Immediate Action: Contact the vendor or consult the official Bevy security portal to verify if a patch is available for your specific deployment. If no patch is currently available, disable SSO integration until the vendor provides a formal security update.

Proactive Monitoring: Review authentication and account modification logs for anomalous email change requests or suspicious SSO login patterns.

Compensating Controls: Implement additional multi-factor authentication (MFA) mechanisms outside of the SSO flow to prevent unauthorized account access if the primary SSO mechanism is compromised.

Public Exploit Available: Yes, a proof-of-concept exists as documented in a public Gist repository.

Given the potential for account takeover and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations using the Bevy Event service should immediately audit their SSO configurations and monitor for signs of unauthorized account modifications. Prioritize the application of vendor patches as soon as they are released to neutralize this vector.