EUVD-2026-38509
GHSA-hmrw-59p6-9fgx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Low-privileged network attacker reuses web session against admin API; admin API access implies both read and limited write capability, warranting I:L over the original I:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.
AnalysisAI
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID against the XML-RPC API, which is normally restricted to admin-level users. This authentication bypass (CWE-287) grants unauthorized API access, enabling the attacker to chain this foothold with additional API-level vulnerabilities to escalate impact beyond the base CVSS score suggests. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue was disclosed via HackerOne and a fix was implemented by recording session context alongside session data.
Technical ContextAI
Revive Adserver (cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*) is an open-source, self-hosted ad serving platform that exposes two distinct authenticated interfaces: a web-based admin console and an XML-RPC API. The XML-RPC API is intended to be administratively gated, requiring elevated privileges. The root cause, classified as CWE-287 (Improper Authentication), is that the session management layer failed to bind session identifiers to a specific interface context - a session ID generated for the web console carried no marker identifying it as belonging exclusively to that context. As a result, the API authentication logic accepted web-console session tokens as valid, effectively collapsing the trust boundary between the two interfaces. The fix involves stamping session records with their originating context (web vs. API) to enforce strict context-to-token binding.
RemediationAI
Upgrade to a patched version of Revive Adserver in which the session context (web console vs. XML-RPC API) is recorded alongside session data, preventing cross-context session ID reuse. An exact fixed version number is not confirmed from the available data - consult the HackerOne report at https://hackerone.com/reports/3672641 and the official Revive Adserver release notes for the specific patched release. As a compensating control prior to patching, restrict network access to the XML-RPC API endpoint via firewall rules or web server ACLs so that only trusted IP ranges (e.g., known integration hosts) can reach it, reducing the exposure to low-privileged console users who could otherwise target the API. This workaround does not eliminate the flaw but meaningfully narrows the attack surface.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to by
Ownership validation bypass in Revive Adserver 6.0.7 and earlier allows a low-privileged authenticated user to link thei
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today