Reflected Cross-Site Scripting Vulnerability in Revive Adserver
CVE-2026-108559

6.1MEDIUM

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-108559?

A reflected cross-site scripting vulnerability has been identified in the iframe invocation options of Revive Adserver versions prior to 6.0.9. This flaw allows an unauthenticated attacker to execute malicious JavaScript in the context of an authenticated user's browser session by directing them to a specially crafted URL. The vulnerability arises from improper handling of HTML attributes, specifically the inclusion of frame_width and frame_height parameters without adequate encoding. Users are urged to update to Revive Adserver 6.0.9 or later, where this issue has been addressed by implementing proper HTML encoding for the affected values.

Affected Version(s)

Adserver 0 <= 6.0.8

References

https://hackerone.com/reports/3908050

CVSS V3.0

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Rayyan Aryasatya (kannrisha)
.