Username normalization missing allows visually indistinguishable accounts (Whitespace-Based Impersonation)

How it was found

Version:

==revive-adserver 6.0.2==

Summary:

Revive Adserver allows creation of usernames containing leading or trailing whitespace (e.g. "admin" or " admin"). The UI does not visibly differentiate such usernames from admin, producing visually identical accounts. This can be used to impersonate administrators, confuse operators, and hide malicious activity. The issue is primarily an information/UX vulnerability and does not directly grant elevated privileges, but it increases risk of social engineering and audit/logging confusion.

Step to reprocude:

1. Log in to Revive Adserver with an account that can create users.
2. Go to Users Access→ Add User.
3. Create a new user with a username containing leading or trailing spaces, for example: " admin".
4. Save the new user. Open the user list or any UI that displays usernames — the new account appears visually identical (or very hard to distinguish) from the admin account

Video PoC: ███

Impact

• Attackers can create accounts that appear identical to privileged accounts, facilitating impersonation and social-engineering attacks
• Human review of logs or UI may misattribute actions to the legitimate admin account, complicating incident response.