EUVD-2026-38504
GHSA-9wv7-mm8f-m6cx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
API authentication required for addUser access (PR:L); stored XSS requires admin to view user list (UI:R); payload executes in victim browser with scope change (S:C), enabling session hijack (C:H) and impersonation (I:H).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.
AnalysisAI
Revive Adserver's XML-RPC API addUser method contains a validation bypass regression introduced by the patch for CVE-2025-55129, allowing authenticated API users to register usernames containing malicious payloads that enable impersonation of other accounts or deliver stored cross-site scripting attacks against administrative users. Reported via HackerOne (report #3680090), this vulnerability is not listed in CISA KEV and no public exploit has been identified at time of analysis. The provided CVSS vector is a null placeholder with all impact metrics rated N, which directly contradicts the described integrity and confidentiality impacts of stored XSS and account impersonation, and must not be used for risk prioritization.
Technical ContextAI
Revive Adserver (CPE: cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*) is an open-source, self-hosted ad serving platform that exposes an XML-RPC API for programmatic management, including user account provisioning via the addUser method. XML-RPC is a remote procedure call protocol encoding requests and responses as XML over HTTP. The root cause is inadequate input validation on the username parameter within addUser - a regression specifically introduced when patching CVE-2025-55129, meaning the prior fix removed or relocated a validation check that was required to sanitize user-supplied username strings. CWE-287 (Improper Authentication) is the listed classification and partially applies via the impersonation vector, but the primary technical failure is closer to CWE-20 (Improper Input Validation) and CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). The stored XSS pathway arises when the malicious username is later rendered in the administrative interface without escaping.
RemediationAI
The vulnerability description states that proper validation has been added, confirming a fix exists upstream, but no specific patched version number was identified in the available data. Administrators should consult the Revive Adserver project release page and the HackerOne disclosure at https://hackerone.com/reports/3680090 to identify the exact fixed version and upgrade immediately. As compensating controls pending patching: restrict access to the XML-RPC API endpoint at the network layer (firewall or reverse proxy ACL) so only trusted internal IP ranges can call addUser - this eliminates remote exploitation without disrupting non-API functionality. Additionally, audit all existing usernames in the database for suspicious strings containing angle brackets, script tags, or close-duplicate names mimicking administrator accounts, and remove or rename any found. Disabling XML-RPC entirely removes the attack surface but will break any automated user provisioning pipelines dependent on the API. No side-effect-free workaround short of patching has been confirmed.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to by
Same weakness CWE-287 – Improper Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today