Revive Adserver · Report #3781492
PHP code injection in delivery-limitation `logical` validation bypass - XML-RPC setChannelTargeting
Validstatus
highseverity
46upvotes
25 Jun 2026disclosed
Summary
HackerOne community member Rio Darmawan (riodrwn) and Mikhail Ilin (doomtech) have independently reported new vectors to bypass the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as type, or using the ox.setChannelTargeting XML-RPC API method.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.