Cross-Site Request Forgery in Revive Adserver by Revive Adserver Team

CVE-2026-77168

What is CVE-2026-77168?

The Revive Adserver software is susceptible to a cross-site request forgery vulnerability found in tracker-invocation.php. This flaw allows an authenticated attacker to alter a tracker's details, including its name, description, and advertiser assignment. The vulnerability arises from an unverified state-changing request handler that lacks proper CSRF token validation, posing serious risks if an attacker can trick a victim into making a malicious request. The issue has been addressed in version 6.0.9 where the exploitative handler has been removed, mitigating any potential abuse.

References