EUVD-2026-39602
GHSA-66rh-2cvm-487w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable code injection needs only a low-privilege account (PR:L) and no interaction; arbitrary code execution yields full C/I/A impact with low complexity.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as type, or using the ox.setChannelTargeting XML-RPC API method.
AnalysisAI
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for CVE-2026-34916, either by supplying a disallowed-but-valid plugin identifier in the type parameter or by abusing the ox.setChannelTargeting XML-RPC API method. The flaw lets an attacker inject and execute arbitrary code (CWE-94) on the server, fully compromising confidentiality, integrity, and availability. Reported via HackerOne by multiple researchers (including phucrio and offsetmd); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Revive Adserver is an open-source PHP-based ad-management and ad-serving platform (CPE cpe:2.3:a:revive:adserver). The root cause is CWE-94 (Improper Control of Generation of Code / code injection): the application loads plugin logic based on a caller-supplied plugin type identifier, and the original CVE-2026-34916 patch attempted to restrict which identifiers were permitted. This follow-up vulnerability shows the allow/deny logic is incomplete - a type value that is structurally valid yet not actually allowed still slips through, and the ox.setChannelTargeting XML-RPC method exposes a second, equivalent path into the same code-loading sink. Because plugin identifiers ultimately map to executable code, controlling them yields arbitrary code execution.
RemediationAI
No vendor-released patch version is identified in the available data, so a specific upgrade target cannot be cited; monitor the official Revive Adserver security advisories and the linked HackerOne reports (https://hackerone.com/reports/3780854, https://hackerone.com/reports/3781492) and apply the corrected fix as soon as it is published, since this CVE demonstrates the earlier CVE-2026-34916 fix is incomplete. As compensating controls until a fix lands, restrict or disable the XML-RPC interface (which exposes the ox.setChannelTargeting method) at the web-server or application layer - this blocks one of the two known vectors but breaks any legitimate XML-RPC integrations; additionally, tighten account provisioning and revoke unnecessary low-privilege accounts to remove the PR:L foothold the attack depends on, and place the admin/API surface behind network ACLs or a VPN so it is not internet-reachable, accepting that remote operators will then need the VPN to manage campaigns.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to by
Ownership validation bypass in Revive Adserver 6.0.7 and earlier allows a low-privileged authenticated user to link thei
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today