CVE-2026-50745: Reflected XSS in Revive Adserver stats-video.php

Technical summary

CVE-2026-50745 is a reflected cross-site scripting (CWE-79) vulnerability in Revive Adserver. The stats-video.php script constructs URLs without following secure coding practices. Specifically, the output of a Smarty custom helper function (url) lacks proper HTML encoding and input sanitization, allowing attacker-controlled parameters to be reflected directly into the response. An unauthenticated, remote attacker can exploit this by crafting a malicious URL and delivering it to a victim. No special privileges or complex conditions are required; only user interaction (clicking the link) is needed.

Business impact

This vulnerability enables attackers to steal session cookies, redirect users to phishing pages, inject malware, or perform actions on behalf of logged-in ad operators. For organizations running Revive Adserver—commonly used for managing digital advertising campaigns—a successful exploit could compromise advertiser accounts, skew ad performance metrics, or damage trust with the platform's users. The impact depends on what sensitive operations a victim can perform after their session is hijacked.

Affected systems

Revive Adserver instances are affected. The vulnerability exists in the stats-video.php script. Organizations should verify which versions of Revive Adserver they are running against the vendor advisory to determine exposure. All installations of affected versions accessible over the network are at risk if users can be tricked into clicking malicious links.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to craft a malicious URL, social engineer a user into clicking it, and intercept or exfiltrate the resulting data or session tokens. The CVSS 3.1 score of 6.1 (Medium) reflects the requirement for user interaction. The attack vector is network-based with no authentication required. Tools for automating reflected XSS detection and exploitation are widely available, making this a practical concern even for low-skill attackers.

Remediation

Upgrade Revive Adserver to a patched version as specified in the vendor advisory. Verify against the official Revive Adserver security bulletins for exact version numbers and release dates. In addition to patching, implement Content Security Policy (CSP) headers to mitigate XSS attacks, use HTML entity encoding for all user-supplied output, and ensure input validation follows OWASP guidelines. Consider security code review of custom Smarty helper functions and template rendering logic.

Patch guidance

Consult the official Revive Adserver advisory for patched version numbers and availability. Apply patches promptly, testing first in a non-production environment to ensure compatibility with your ad server configuration. After patching, perform a brief regression test of the stats-video.php functionality to confirm proper operation. If patches are not yet available from the vendor, apply compensating controls such as web application firewalls (WAF) rules to block requests with suspicious characters in URL parameters targeting stats-video.php.

Detection guidance

Monitor web server logs for requests to stats-video.php with unusual characters or payloads in query parameters—particularly angle brackets, script tags, or JavaScript event handlers (e.g., onerror=, onclick=). Deploy a WAF or IDS/IPS with XSS signature rules to detect and block malicious requests. Review access logs for successful reflections of user input or unusual redirect patterns. Track for any evidence of session hijacking or unauthorized ad server administrative actions that might indicate exploitation.

Why prioritize this

Although the CVSS score is Medium (6.1) and the vulnerability requires user interaction, reflected XSS in ad-serving software is a realistic attack vector because ad operators and advertisers regularly exchange URLs. The combination of network accessibility, ease of exploitation, and potential for session hijacking or data exfiltration warrants timely patching. Organizations should prioritize this within their normal patch cycle but can plan it as a standard update rather than an emergency.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects a reflected XSS with no authentication required (PR:N), network accessibility (AV:N), low attack complexity (AC:L), and cross-site scope (S:C). The severity is capped at Medium because successful exploitation requires user interaction (UI:R). Confidentiality and integrity are each rated as low impact (C:L, I:L), acknowledging that session hijacking and minor data theft are possible but availability is not directly compromised (A:N).

Frequently asked questions