CVE-2026-50745: Revive Adserver XSS Vulnerability

CVE-2026-50745 Overview

CVE-2026-50745 is a reflected Cross-Site Scripting (XSS) vulnerability in Revive Adserver. The flaw resides in the stats-video.php script, where user-supplied input is reflected in output without proper encoding or sanitisation. The Smarty custom helper function url fails to escape data before rendering it back to the client. Attackers can craft malicious URLs that execute arbitrary JavaScript in a victim's browser when clicked. The issue is tracked under CWE-79 and was disclosed through HackerOne Report #3793243.

Critical Impact
Successful exploitation allows attackers to execute arbitrary scripts in the context of an authenticated Revive Adserver user, enabling session theft, unauthorised administrative actions, and phishing against ad operations staff.

Affected Products

Revive Adserver (revive-adserver:revive_adserver)
stats-video.php script component
Smarty template helper function url

Discovery Timeline

2026-06-26 - CVE-2026-50745 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-50745

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the stats-video.php reporting script within Revive Adserver. URLs pointing to this script were constructed in a manner that deviated from established output encoding practices. The Smarty custom helper function url returned data that was neither HTML-encoded nor sanitised before being embedded into the page response. As a result, an attacker can inject markup or JavaScript payloads through URL parameters. When a victim visits the crafted link, the browser interprets the injected content as executable code within the trusted application origin. Exploitation requires user interaction, and the scope changes across a security boundary, allowing the payload to affect resources beyond the vulnerable component.

Root Cause

The root cause is missing output encoding in the Smarty url helper combined with insecure URL construction patterns in stats-video.php. User input flowing through the helper is placed directly into the rendered output without contextual escaping for HTML or JavaScript contexts. This violates the standard defence for CWE-79, which requires encoding untrusted data at each output sink.

Attack Vector

The attack is network-based and requires the victim to click a crafted link or visit an attacker-controlled page that references the vulnerable URL. No prior authentication is required to craft the payload, but a victim session in Revive Adserver amplifies impact. Once the script executes, attackers can read accessible cookies, forge requests to administrative endpoints, or serve deceptive content within the adserver interface. Technical details are available in HackerOne Report #3793243.

Detection Methods for CVE-2026-50745

Indicators of Compromise

Web server access logs containing requests to stats-video.php with query parameters holding HTML tags, javascript: schemes, or event handlers such as onerror= and onload=.
Referer headers pointing to external domains followed by requests to Revive Adserver reporting endpoints.
Unexpected outbound requests from authenticated user sessions immediately after visiting adserver report URLs.

Detection Strategies

Inspect HTTP requests to /stats-video.php for URL-encoded script fragments, angle brackets, and quote characters in parameter values.
Deploy Web Application Firewall (WAF) rules that identify reflected XSS payload signatures targeting Smarty-rendered endpoints.
Correlate authenticated session activity with anomalous script-loaded resources originating from the adserver domain.

Monitoring Recommendations

Enable verbose access logging on the Revive Adserver frontend and forward logs to a centralised analytics platform for query pattern analysis.
Alert on browser Content Security Policy (CSP) violation reports referencing inline script execution from the adserver origin.
Monitor administrator account activity for session anomalies following clicks on external report links.

How to Mitigate CVE-2026-50745

Immediate Actions Required

Upgrade Revive Adserver to the latest version released by the maintainers that addresses the stats-video.php sanitisation flaw.
Restrict access to the reporting interfaces via IP allow-lists or VPN until the patch is applied.
Educate administrators to avoid clicking untrusted report or statistics URLs pending remediation.

Patch Information

Refer to the vendor advisory linked from HackerOne Report #3793243 for patched release details. Apply the fixed version once available and verify that the Smarty url helper output is properly encoded in your deployment.

Workarounds

Deploy WAF signatures that block script-like payloads in query parameters targeting stats-video.php.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Set the HttpOnly and SameSite=Strict flags on session cookies to reduce impact of successful script execution.

bash

# Example nginx rule to block angle brackets in stats-video.php parameters
location = /stats-video.php {
    if ($args ~* "(<|%3C|script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://revive_backend;
}