VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jun 26, 2026· Updated Jun 29, 2026

CVE-2026-50744

CVE-2026-50744

Description

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.

Affected products

2
  • Revive Adserver/Adserver2 versions
    cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*range: <6.0.8
    • (no CPE)range: <6.0.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.