[REVIVE-SA-2026-001] Revive Adserver Vulnerabilities
Matteo Beccati ·
========================================================================
Revive Adserver Security Advisory REVIVE-SA-2026-001
------------------------------------------------------------------------
https://www.revive-adserver.com/security/revive-sa-2026-001
------------------------------------------------------------------------
Date: 2026-01-14
Risk Level: High
Applications affected: Revive Adserver
Versions affected: <= 6.0.4
Versions not affected: >= 6.0.5
Website: https://www.revive-adserver.com/
========================================================================
========================================================================
Vulnerability 1: Format string injection
========================================================================
Vulnerability Type: Use of Externally-Controlled Format String
[CWE-134]
CVE-ID: CVE-2026-21640
Risk level: Low
CVSS Base Score: 2.7
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
========================================================================
Description
-----------
Details
-------
References
----------
https://hackerone.com/reports/3445332
https://github.com/revive-adserver/revive-adserver/commit/c40187d8
https://cwe.mitre.org/data/definitions/134.html
========================================================================
Vulnerability 2: Authorization Bypass
========================================================================
Vulnerability Type: Authorization Bypass Through User-Controlled Key
[CWE-639]
CVE-ID: CVE-2026-21641
Risk level: High
CVSS Base Score: 7.1
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
========================================================================
Description
-----------
Details
-------
References
----------
https://hackerone.com/reports/3445710
https://github.com/revive-adserver/revive-adserver/commit/f6059335
https://cwe.mitre.org/data/definitions/639.html
========================================================================
Vulnerability 3: Reflected XSS
========================================================================
Vulnerability Type: Improper Neutralization of Input During Web Page
Generation (‘Cross-site Scripting’) [CWE-79]
CVE-ID: CVE-2026-21642
Risk level: Medium
CVSS Base Score: 6.1
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
========================================================================
Description
-----------
Details
-------
References
----------
https://hackerone.com/reports/3470970
https://github.com/revive-adserver/revive-adserver/commit/e245a88
https://github.com/revive-adserver/revive-adserver/commit/0ebc96d
https://cwe.mitre.org/data/definitions/79.html
========================================================================
Vulnerability 4: Reflected XSS
========================================================================
Vulnerability Type: Improper Neutralization of Input During Web Page
Generation (‘Cross-site Scripting’) [CWE-79]
CVE-ID: CVE-2026-21663
Risk level: Medium
CVSS Base Score: 6.1
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
========================================================================
Description
-----------
Details
-------
References
----------
https://hackerone.com/reports/3473696
https://github.com/revive-adserver/revive-adserver/commit/c130eb0
https://cwe.mitre.org/data/definitions/79.html
========================================================================
Vulnerability 5: Reflected XSS
========================================================================
Vulnerability Type: Improper Neutralization of Input During Web Page
Generation (‘Cross-site Scripting’) [CWE-79]
CVE-ID: CVE-2026-21664
Risk level: Medium
CVSS Base Score: 6.1
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
========================================================================
Description
-----------
Details
-------
References
----------
https://hackerone.com/reports/3468169
https://github.com/revive-adserver/revive-adserver/commit/e88e9ed
https://github.com/revive-adserver/revive-adserver/commit/7a99f69
https://cwe.mitre.org/data/definitions/79.html
========================================================================
Solution
========================================================================
========================================================================
Contact Information
========================================================================
The security contact for Revive Adserver can be reached at:
<security AT revive-adserver DOT com>.
--
Matteo Beccati
On behalf of the Revive Adserver Team
https://www.revive-adserver.com/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/