# CVE-2026-44961: Revive Adserver validation bypass in XML-RPC API addUser method

Source: https://junglewise.ai/threats/cve-2026-44961-revive-adserver-validation-bypass-in-xml-rpc-api-adduser-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-44961 · Severity: info · CVSS 0 · Published 2026-06-23

A vulnerability in the Revive Adserver software allows users with API access to bypass username validation rules. This flaw could be used to create malicious usernames that facilitate account impersonation or launch cross-site scripting (XSS) attacks against other users. Such an exploit could compromise the integrity of the advertising platform and lead to unauthorized access or data theft.

Technologies: [Revive-Adserver Adserver](https://junglewise.ai/threats/technologies/adserver). Vendors: [Revive-Adserver](https://junglewise.ai/threats/vendors/revive-adserver).

## Quick answers

**Is CVE-2026-44961 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44961 being exploited in the wild.

**How severe is CVE-2026-44961?** Informational severity, with a CVSS score of 0, published 23 June 2026.

**Which products and versions are affected?** Revive-Adserver Adserver <= 6.0.6.

**Is there a fix for CVE-2026-44961?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44961 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44961?** Check whether you run Revive-Adserver Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A validation bypass exists in the addUser method of the XML-RPC API in Revive Adserver versions 6.0.6 and earlier. This flaw was introduced as a regression in a previous security fix (CVE-2025-55129). The vulnerability allows an attacker with API access to bypass input sanitization when creating new users, enabling the injection of payloads for stored Cross-Site Scripting (XSS) or the creation of usernames that mimic existing accounts for impersonation. The issue is classified under CWE-287 (Improper Authentication) and has been addressed by adding proper validation to the affected method.

## Affected products

- Revive Adserver <= 6.0.6

## Timeline

- 2026-06-23: disclosed
- 2026-06-23: advisory

## References

- [https://hackerone.com/reports/3680090](https://hackerone.com/reports/3680090)

## Related threats

- [Revive Adserver CSRF in zone-include.php](https://junglewise.ai/threats/cve-2026-50743-revive-adserver-csrf-in-zone-include-php)
- [Revive Adserver reflected XSS in stats-video.php](https://junglewise.ai/threats/cve-2026-50745-revive-adserver-reflected-xss-in-stats-video-php)
- [Revive Adserver auth bypass in XML-RPC API](https://junglewise.ai/threats/cve-2026-50744-revive-adserver-auth-bypass-in-xml-rpc-api)
- [Revive Adserver stored XSS in maintenance tools](https://junglewise.ai/threats/cve-2026-50742-revive-adserver-stored-xss-in-maintenance-tools)
- [Revive Adserver code injection bypass in XML-RPC API](https://junglewise.ai/threats/cve-2026-50741-revive-adserver-code-injection-bypass-in-xml-rpc-api)