Vulnerability DatabaseCVE-2026-44961
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-44961
Published:June 23, 2026
Updated:August 06, 2026
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.
Affected Packages
https://github.com/revive-adserver/revive-adserver.git (GITHUB):
Affected version(s) >=v2.8.5 <v6.0.7
Fix Suggestion:
Update to version v6.0.7
Related Resources (1)
https://hackerone.com/reports/3680090
Do you need more information?
Contact Us
Weakness Type (CWE)
Improper Authentication
CWE-287
EPSS
Base Score:
0.34