Reflected Cross-Site Scripting Vulnerability in Revive Adserver

CVE-2026-108558

What is CVE-2026-108558?

A reflected cross-site scripting vulnerability exists in Revive Adserver, impacting version 6.0.8 and earlier. This security flaw allows an unauthenticated attacker to inject and execute JavaScript code in the browser of an authenticated user. By enticing users to click on a specially crafted URL, attackers can manipulate the input validated by the application, enabling unauthorized script execution. The vulnerability arises from an incorrect ownership check, which improperly validates the advertiser identifier instead of the intended website identifier. Additionally, a related output encoding flaw affects the hour parameter. Revive Adserver addressed this issue in version 6.0.9 by implementing robust checks and normalizing the relevant parameters to prevent such attacks.

References