CVE-2026-50744: Revive Adserver Auth Bypass Vulnerability

CVE-2026-50744 Overview

CVE-2026-50744 is an access control weakness [CWE-284] in Revive Adserver 6.0.7. The XML-RPC API exposes an ox.login method that is intended to be restricted to administrators. When invoked with invalid credentials, the method returns an error response as expected. However, the HTTP response headers still include a valid session ID cookie, and the associated server-side session is not invalidated. An authenticated low-privilege attacker can extract this leaked session identifier and reuse it to invoke subsequent XML-RPC API calls without being subject to the admin-only restriction.

Critical Impact
A low-privilege authenticated user can obtain a valid session cookie from a failed ox.login call and reuse it to bypass admin-only restrictions on the XML-RPC API.

Affected Products

Revive Adserver 6.0.7
revive-adserver:revive_adserver (see CPE for affected range)
Deployments exposing the XML-RPC endpoint over the network

Discovery Timeline

2026-06-26 - CVE-2026-50744 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-50744

Vulnerability Analysis

Revive Adserver exposes an XML-RPC interface that supports several remote methods, including ox.login. The ox.login method is documented as restricted to administrators. The implementation performs the authorization check and returns an XML-RPC fault when the caller is not permitted. The defect lies in how the underlying session is handled during that error path.

When ox.login is invoked, the server creates or references a session and emits a Set-Cookie header carrying the session identifier in the HTTP response. The error-return path does not destroy or invalidate this session. The caller therefore receives a working session cookie alongside the error body. Subsequent XML-RPC calls that present this cookie are treated as belonging to an authenticated session and bypass the admin-only restriction.

Root Cause

The root cause is improper access control [CWE-284] combined with incorrect session lifecycle management. The authorization check rejects the operation at the API layer, but the session layer never revokes the identifier that was already issued. The two layers are not coordinated on failure.

Attack Vector

Exploitation requires network access to the XML-RPC endpoint and a set of low-privilege credentials sufficient to submit an authenticated request. The attacker calls ox.login and captures the Set-Cookie header from the HTTP response. The attacker then reuses that cookie in later XML-RPC requests to invoke methods normally gated behind the admin restriction. No user interaction is required, and no memory corruption or code injection is involved. See the HackerOne Report #3783738 for the reporter's technical write-up.

Detection Methods for CVE-2026-50744

Indicators of Compromise

XML-RPC requests to ox.login that return an error while the response still carries a Set-Cookie header with a session identifier.
Reuse of a session cookie by a client that never completed a successful authentication against the XML-RPC endpoint.
Sequences of XML-RPC method calls from non-admin accounts that succeed against admin-restricted methods.

Detection Strategies

Inspect web server and application logs for ox.login calls immediately followed by additional XML-RPC calls from the same source using the newly issued session cookie.
Correlate authentication failures on ox.login with subsequent authenticated activity tied to the same session ID.
Alert on XML-RPC methods intended for administrators being invoked by principals whose account role is not administrator.

Monitoring Recommendations

Enable verbose access logging on the Revive Adserver XML-RPC endpoint and forward logs to a centralized platform for correlation.
Track distinct session IDs per user account and flag sessions that are used across mismatched identities or after failed logins.
Monitor for abnormal spikes in XML-RPC traffic from low-privilege users targeting admin-only methods.

How to Mitigate CVE-2026-50744

Immediate Actions Required

Upgrade Revive Adserver to a release that addresses CVE-2026-50744 as soon as a fixed version is published by the maintainer.
Restrict network access to the XML-RPC endpoint using firewall rules, reverse proxy ACLs, or VPN-only access until patched.
Rotate credentials for any accounts that could have been used to obtain a leaked session cookie.

Patch Information

No vendor advisory URL is listed in the NVD record at time of publication. Refer to the upstream Revive Adserver project release notes and the HackerOne Report #3783738 for fix availability and version guidance. Apply the vendor-supplied update once released.

Workarounds

Disable the XML-RPC interface if it is not required by the deployment.
Place the XML-RPC endpoint behind an authenticating reverse proxy that terminates untrusted sessions on API errors.
Force session invalidation on failed authorization by clearing server-side session state and instructing clients to discard cookies received on error responses.

bash

# Example: block external access to the XML-RPC endpoint at the reverse proxy
# nginx configuration snippet
location /www/api/v2/xmlrpc/ {
    allow 10.0.0.0/8;    # internal management network only
    deny  all;
    proxy_pass http://revive_backend;
}