CVE-2026-50741 | Bypass to the fix for CVE-2026-34916. Variants of such vecto… | CVSS 8.8 HIGH

Description

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method.

Metadata

CVE ID: CVE-2026-50741
State: PUBLISHED
Assigner: hackerone
Reserved: 2026-06-06 15:00 UTC
Published: 2026-06-26 01:11 UTC
Last updated: 2026-06-26 12:27 UTC
Primary CWE: CWE-94
CWE-94 Code Injection
Vendor / Product: Revive / Adserver
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Revive	Adserver	—	0 ≤ 6.0.7

Weakness (CWE)

CWE	Source	Description
CWE-94	cna	CWE-94 Code Injection

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (2)