EUVD-2026-39600
GHSA-q5xg-wh3x-vmcf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable API with PR:L (account required); bypassing admin restriction enables both read and write admin API actions, warranting I:L over the vendor's I:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
AnalysisAI
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to bypass the admin-only restriction on that API. The ox.login method issues a valid session cookie in HTTP response headers before completing credential validation; when authentication fails, the error is returned to the caller but the underlying server-side session is never torn down. A threat actor who captures that leaked cookie can then replay it to invoke otherwise admin-restricted XML-RPC methods without possessing admin credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Revive Adserver is an open-source ad serving platform that exposes a management XML-RPC API. The ox.login endpoint is the designated authentication entry point for that API and is documented as admin-only. The root cause is CWE-284 (Improper Access Control): the server allocates and persists a session object - and writes the resulting session ID into the HTTP Set-Cookie response header - before the credential-validation logic determines whether the login should succeed. When the credentials are rejected and an error code is returned in the XML-RPC response body, the session record is never invalidated in the backing session store. An attacker can therefore initiate a login attempt with any credentials, intercept the Set-Cookie value from the HTTP headers, discard the error body, and present that session token on subsequent API calls. The affected product CPE is cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*, and the confirmed version cited in the disclosure is 6.0.7.
RemediationAI
Consult the HackerOne disclosure at https://hackerone.com/reports/3783738 for patch availability - no vendor-released fixed version has been independently confirmed in the available data. Until an official patch is applied, the most actionable compensating control is to restrict network access to the XML-RPC endpoint (typically /api/xmlrpc/) via web-server ACLs or a WAF rule, allowing only trusted admin IP ranges; this eliminates remote exploitation at the cost of restricting legitimate remote admin access. Alternatively, if the XML-RPC API is not required for day-to-day operations, disabling the endpoint entirely in the web server configuration eliminates the attack surface with no operational impact for UI-based administration. Session management hardening - ensuring sessions are explicitly destroyed server-side on any authentication failure - is the root-cause fix that should be validated in the vendor patch.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Ownership validation bypass in Revive Adserver 6.0.7 and earlier allows a low-privileged authenticated user to link thei
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today