CVE-2026-50744: Medium severity Revive Revive Adserver vulnerability
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.7 - Operational
Invalidate the leaked session after the ox.login method returns an error (the API call returned a session ID cookie in HTTP headers but the associated session was not invalidated).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50744?
The severity of CVE-2026-50744 is medium, with a score of 4.3.
How do I fix CVE-2026-50744?
To fix CVE-2026-50744, ensure you update to the latest version of Revive Adserver that addresses this vulnerability.
What does CVE-2026-50744 expose?
CVE-2026-50744 exposes a bypass to the admin-only restriction of the XML-RPC API in Revive Adserver.
What versions of Revive Adserver are affected by CVE-2026-50744?
CVE-2026-50744 specifically affects Revive Adserver version 6.0.7.
What type of attack does CVE-2026-50744 facilitate?
CVE-2026-50744 facilitates potential unauthorized access through a session ID leak in the XML-RPC API.