CVE-2026-50742 Overview
CVE-2026-50742 is a stored Cross-Site Scripting (XSS) vulnerability affecting Revive Adserver version 6.0.7. The flaw resides in the maintenance-acl-check.php and maintenance-banners-check.php maintenance tools. Entity names are rendered without proper output escaping when the tools detect data inconsistencies. An authenticated attacker with low privileges can inject malicious JavaScript that executes in an administrator's browser when the maintenance tools run. Execution of the payload depends on administrator interaction with the affected tools, which limits attacker control over triggering. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated low-privilege users can store JavaScript payloads that execute in an administrator's session context when maintenance checks display inconsistent entity names.
Affected Products
- Revive Adserver 6.0.7
- maintenance-acl-check.php tool
- maintenance-banners-check.php tool
Discovery Timeline
- 2026-06-26 - CVE-2026-50742 published to NVD
- 2026-06-29 - Last updated in NVD database
Technical Details for CVE-2026-50742
Vulnerability Analysis
The vulnerability exists in two Revive Adserver maintenance utilities: maintenance-acl-check.php and maintenance-banners-check.php. These scripts scan the ad-serving database for inconsistencies in access control lists and banner records. When an inconsistency is detected, the tools render the associated entity name in the resulting output page. The entity name is displayed without HTML entity encoding or contextual output escaping. A user who can create or modify entities such as banners, zones, or campaigns can inject HTML or JavaScript into an entity name field. The stored payload persists in the database until the maintenance tool is executed by a privileged user.
Root Cause
The root cause is missing output encoding in the maintenance report rendering logic. Input written to entity name fields is stored verbatim and later echoed into HTML context without calling an escape routine such as htmlspecialchars(). This is a classic [CWE-79] failure to neutralize user-controlled data before including it in a web page response.
Attack Vector
An attacker requires authenticated access to Revive Adserver with sufficient privileges to create or edit entities carrying names. The attacker embeds a script payload in an entity name and introduces conditions that trigger an inconsistency flag. When an administrator later runs the affected maintenance check, the browser parses and executes the injected script under the administrator's session. Successful exploitation can lead to session token theft, unauthorized administrative actions, or pivoting into the ad-serving configuration.
No verified proof-of-concept code has been published. Technical details are available in HackerOne Report #3781311.
Detection Methods for CVE-2026-50742
Indicators of Compromise
- Entity names in the Revive Adserver database containing <script, onerror=, onload=, or javascript: substrings.
- Unexpected outbound HTTP requests from administrator browsers immediately after running maintenance tools.
- Web server logs showing administrator access to maintenance-acl-check.php or maintenance-banners-check.php followed by anomalous session activity.
Detection Strategies
- Query the Revive Adserver database for entity name columns containing HTML tags or JavaScript event handlers.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script violations originating from maintenance pages.
- Review web application firewall logs for POST requests to entity creation endpoints containing script payloads.
Monitoring Recommendations
- Alert on new or modified entity names that fail an HTML sanitization regex check.
- Monitor administrator session activity, cookie exfiltration attempts, and privilege changes shortly after maintenance tasks execute.
- Track access to the www/admin/maintenance-*.php paths and correlate with subsequent configuration changes.
How to Mitigate CVE-2026-50742
Immediate Actions Required
- Upgrade Revive Adserver to the version released by the vendor that patches CVE-2026-50742.
- Audit all existing entity name fields (banners, zones, campaigns, ACLs) for stored HTML or JavaScript content and sanitize them.
- Restrict access to maintenance tools to administrator accounts on trusted networks only.
Patch Information
Revive Adserver 6.0.7 is confirmed affected. Administrators should consult the HackerOne Report #3781311 and the Revive Adserver project release notes for the fixed version and apply the update. The fix applies output escaping to entity names rendered by maintenance-acl-check.php and maintenance-banners-check.php.
Workarounds
- Enforce a strict Content Security Policy that blocks inline script execution within the admin interface.
- Limit account privileges for users who can create or edit entities to reduce the pool of potential attackers.
- Manually sanitize entity name inputs at the application layer until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
