Executive brief
A vulnerability in the Revive Adserver software allows users with API access to bypass username validation rules. This flaw could be used to create malicious usernames that facilitate account impersonation or launch cross-site scripting (XSS) attacks against other users. Such an exploit could compromise the integrity of the advertising platform and lead to unauthorized access or data theft.
Technical details
A validation bypass exists in the addUser method of the XML-RPC API in Revive Adserver versions 6.0.6 and earlier. This flaw was introduced as a regression in a previous security fix (CVE-2025-55129). The vulnerability allows an attacker with API access to bypass input sanitization when creating new users, enabling the injection of payloads for stored Cross-Site Scripting (XSS) or the creation of usernames that mimic existing accounts for impersonation. The issue is classified under CWE-287 (Improper Authentication) and has been addressed by adding proper validation to the affected method.
Affected products
- Revive Adserver <= 6.0.6
Timeline
- 2026-06-23: disclosed
- 2026-06-23: advisory