Revive Adserver · Report #3680090

Stored XSS via malicious usernames in audit log details + Username validation bypass in XML‑RPC addUser

Validstatus

9upvotes

3 Jun 2026disclosed

Summary

HackerOne community member barcrange (3l4) has reported that usernames could be used as a vector for a stored XSS attack. When an admin user viewed the audit log details for affected entries, any malicious JavaScript payload embedded in the username would be executed due to missing output sanitisation.

They also reported that the XML‑RPC API addUser method was bypassing the validation rules introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks.

Proper escaping has been added to the audit log details output and validation has been added where it was missing.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original