Executive brief
A security flaw in Revive Adserver allows users with low-level access to the web management console to reuse their login sessions to access the XML-RPC API. This API is normally restricted to administrators, meaning a regular user could gain unauthorized access to administrative functions. This could lead to unauthorized changes to advertising campaigns or exposure of sensitive configuration data.
Technical details
The vulnerability is classified as Improper Authentication (CWE-287) due to session reuse across different security contexts. Specifically, session IDs generated for the web-based administrative interface were valid for authentication against the XML-RPC API, which is intended to be restricted to high-privileged administrative accounts. An attacker with valid low-privileged credentials can capture their session ID and replay it against API endpoints to bypass intended access controls. The fix involves recording the session context (Web vs. API) to ensure session IDs are not interchangeable. The issue affects Revive Adserver versions up to and including 6.0.6.
Affected products
- Revive Adserver <= 6.0.6
Timeline
- 2026-06-23: advisory: NVD publication date