CVE-2026-50741

8.8 Élevée

Publiée le 26/06/2026 à 04:16 · Modifiée le 29/06/2026 à 22:21 · Analysée par le NVD · Source : support@hackerone.com

Description

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.

Traduire en français

Produits concernés

Revive Adserver
Revive-adserver revive adserver

Scores CVSS

Version	Score	Source	Vecteur
3.0	8.8 Élevée	support@hackerone.com	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94

Références

https://hackerone.com/reports/3780854 Issue TrackingThird Party Advisory
https://hackerone.com/reports/3781492 Issue TrackingThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories