CVE-2026-50741: Revive Adserver Auth Bypass Vulnerability

CVE-2026-50741 Overview

CVE-2026-50741 is a bypass of the patch issued for CVE-2026-34916 in Revive Adserver. Attackers with low-privileged authenticated access can circumvent the original fix by supplying a disallowed but syntactically valid plugin identifier through the type parameter, or by invoking the ox.setChannelTargeting XML-RPC API method. The flaw is classified under [CWE-94] (Improper Control of Generation of Code) and enables code injection against Revive Adserver installations. Independent researchers phucrio and offsetmd reported additional variants of these attack vectors.

Critical Impact
Authenticated attackers can achieve remote code execution on Revive Adserver instances, compromising confidentiality, integrity, and availability of the ad-serving infrastructure.

Affected Products

Revive Adserver (all versions containing the incomplete fix for CVE-2026-34916)
Deployments exposing the XML-RPC endpoint ox.setChannelTargeting
Instances allowing plugin identifiers through the type parameter

Discovery Timeline

2026-06-26 - CVE-2026-50741 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-50741

Vulnerability Analysis

CVE-2026-50741 stems from an incomplete remediation of CVE-2026-34916. The original patch attempted to restrict which plugin identifiers could be supplied to code-generating routines, but the validation logic fails to cover all reachable entry points. Attackers can submit plugin identifiers that pass structural validation while remaining on the disallowed list. The result is untrusted input reaching a code-generation sink, triggering the same class of injection flaw the original patch aimed to close.

The secondary path uses the ox.setChannelTargeting XML-RPC API method, which processes targeting expressions without applying the corrected filter. This exposes a parallel attack surface unaffected by the initial fix.

Root Cause

The root cause is inconsistent input validation across the code paths that consume plugin type values and channel targeting expressions. The patch for CVE-2026-34916 hardened one entry point but left equivalent sinks reachable through alternate parameters and the XML-RPC interface. Under [CWE-94], any user-controlled data flowing into dynamic code generation without complete allowlisting permits arbitrary code execution.

Attack Vector

Exploitation requires network access and low-privileged authentication (PR:L) but no user interaction. An authenticated attacker submits a crafted type parameter containing a disallowed plugin identifier, or issues an ox.setChannelTargeting XML-RPC call carrying a malicious payload. Successful exploitation yields code execution in the Revive Adserver process context.

Detailed technical write-ups are available in HackerOne Report #3780854 and HackerOne Report #3781492.

Detection Methods for CVE-2026-50741

Indicators of Compromise

Unexpected XML-RPC requests to ox.setChannelTargeting originating from non-administrative accounts or unusual IP ranges.
HTTP requests containing plugin identifiers in the type parameter that do not match the deployment's installed plugin set.
Newly created files or modified PHP files in Revive Adserver plugin and cache directories following authenticated sessions.
Outbound network connections from the web server process to unfamiliar hosts shortly after targeting-related API calls.

Detection Strategies

Enable verbose access logging on the Revive Adserver front-end and correlate type parameter values against the installed plugin allowlist.
Inspect XML-RPC transaction logs for calls to ox.setChannelTargeting and validate that payload contents match expected targeting schemas.
Deploy web application firewall rules that flag plugin identifiers containing non-alphanumeric characters or path-like sequences.

Monitoring Recommendations

Monitor the web server user for unexpected process spawns such as sh, bash, python, or perl.
Alert on file integrity changes across the Revive Adserver installation directory, especially under plugins/ and var/.
Track authentication events for advertiser and trafficker accounts that immediately precede XML-RPC targeting calls.

How to Mitigate CVE-2026-50741

Immediate Actions Required

Restrict access to the Revive Adserver administrative interface and XML-RPC endpoint to trusted network segments using firewall or reverse-proxy ACLs.
Audit all advertiser, trafficker, and administrator accounts and remove or rotate credentials for any account not in active use.
Review recent logs for evidence of exploitation attempts targeting the type parameter or ox.setChannelTargeting method.

Patch Information

Apply the security update from Revive Adserver that supersedes the incomplete fix for CVE-2026-34916. Consult the referenced HackerOne reports and the vendor's release notes for the fixed version identifier before deployment. Verify the upgrade in a staging environment prior to rolling to production.

Workarounds

Disable the XML-RPC interface if it is not required by integrated systems, or block the ox.setChannelTargeting method at the reverse proxy.
Enforce strict allowlisting of plugin identifiers accepted in the type parameter at the web application firewall layer.
Reduce the privilege level of accounts that interact with targeting APIs to limit the blast radius of a successful bypass.

bash

# Example: block ox.setChannelTargeting at an nginx reverse proxy
location = /www/api/v2/xmlrpc/ {
    if ($request_body ~* "ox\.setChannelTargeting") {
        return 403;
    }
    proxy_pass http://revive_backend;
}