CVE-2026-34913: Revive Adserver Auth Bypass Vulnerability

CVE-2026-34913 Overview

CVE-2026-34913 is a broken access control vulnerability [CWE-284] in Revive Adserver version 6.0.6 and earlier. The flaw resides in the campaign-trackers.php script, which fails to validate ownership when linking trackers to campaigns. A low-privileged authenticated user can link their own trackers to campaigns owned by other managers on the same instance. This creates inconsistent ownership relationships across advertiser boundaries within a shared Revive Adserver deployment. The issue was reported through HackerOne and resolved by adding ownership validation that restricts campaign-tracker links to assets owned by the same advertiser.

Critical Impact
Authenticated low-privileged users can manipulate cross-tenant campaign-tracker relationships, undermining ownership boundaries between advertisers on a shared Revive Adserver instance.

Affected Products

Revive Adserver 6.0.6
All Revive Adserver releases prior to 6.0.6
Multi-tenant Revive Adserver deployments hosting multiple advertiser managers

Discovery Timeline

2026-06-23 - CVE-2026-34913 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-34913

Vulnerability Analysis

The vulnerability resides in the campaign-trackers.php script of Revive Adserver. This script processes requests that associate trackers with campaigns. The script accepts campaign and tracker identifiers from authenticated users but does not verify that both objects belong to the same advertiser. As a result, a manager with valid credentials can submit identifiers referencing campaigns owned by other managers. The server processes the link operation and persists the cross-tenant relationship in the database. Integrity of ownership boundaries is compromised, while confidentiality and availability remain unaffected per the CVSS vector.

Root Cause

The root cause is a missing authorization check in the campaign-tracker linking workflow. Revive Adserver authenticates the requesting user but omits an ownership comparison between the target campaign and tracker. The fix introduces ownership validation that confirms both the campaign and the tracker belong to the same advertiser before persisting the relationship. This pattern aligns with CWE-284 (Improper Access Control).

Attack Vector

Exploitation requires network access to the Revive Adserver web interface and valid low-privileged manager credentials. The attacker submits a crafted request to campaign-trackers.php referencing a campaign ID belonging to another manager and a tracker ID under the attacker's control. No user interaction by the victim is required. The attack does not yield code execution or data exfiltration. It enables tampering with relational integrity between advertisers, which can disrupt reporting accuracy and click-tracking attribution. See the HackerOne Report #3650582 for additional technical details.

Detection Methods for CVE-2026-34913

Indicators of Compromise

Database records in the campaign-trackers association table where the linked campaign and tracker belong to different advertiser accounts.
HTTP POST requests to campaign-trackers.php originating from manager accounts referencing campaign IDs outside their advertiser scope.
Unexpected modifications to campaign-tracker mappings in Revive Adserver audit logs.

Detection Strategies

Run database queries that join campaign-tracker relationships with advertiser ownership and flag mismatches.
Inspect web server access logs for requests to campaign-trackers.php and correlate the submitted campaign identifiers against the requester's advertiser scope.
Review Revive Adserver application logs for tracker-link operations performed by manager accounts on campaigns they do not own.

Monitoring Recommendations

Forward Revive Adserver web and application logs to a centralized SIEM for ownership-anomaly correlation.
Alert when a single manager account links trackers to campaigns associated with multiple distinct advertisers.
Baseline normal campaign-tracker activity per manager and alert on deviations indicating cross-tenant linking.

How to Mitigate CVE-2026-34913

Immediate Actions Required

Upgrade Revive Adserver to a release later than 6.0.6 that contains the ownership validation fix for campaign-trackers.php.
Audit existing campaign-tracker associations and remove any records linking assets across advertiser boundaries.
Review manager account activity in access logs to identify users who may have abused the missing check.

Patch Information

The vendor addressed the issue by adding an ownership validation step in the campaign-tracker linking logic. Campaigns can now only be linked to trackers owned by the same advertiser. Administrators should apply the patched Revive Adserver release referenced in the HackerOne Report #3650582 disclosure.

Workarounds

Restrict manager account creation and limit the number of advertisers sharing a single Revive Adserver instance until patching is complete.
Place the Revive Adserver administrative interface behind network access controls that restrict it to trusted operators.
Implement database-level integrity checks that periodically reconcile campaign-tracker ownership and alert on cross-tenant relationships.

bash

# Configuration example
# Identify cross-advertiser campaign-tracker links in the Revive Adserver database
mysql -u revive_user -p revive_db -e "\
SELECT ct.campaign_id, ct.tracker_id, c.clientid AS campaign_owner, t.clientid AS tracker_owner \
FROM ox_campaigns_trackers ct \
JOIN ox_campaigns c ON ct.campaign_id = c.campaignid \
JOIN ox_trackers t ON ct.tracker_id = t.trackerid \
WHERE c.clientid <> t.clientid;"