Revive Adserver · Report #3908050
Reflected XSS via invocation iFrame size fields
Validstatus
mediumseverity
1upvotes
11 Nov 2026disclosed
Summary
Description
HackerOne community member Adam Rayyan Aryasatya (kannrisha) has reported reflected XSS in the iframe invocation options. The frame_width and frame_height request parameters could be included in HTML attributes without appropriate encoding when generating invocation tags for an any-size zone. An attacker can send a crafted URL to an authenticated user to execute JavaScript in that user's browser.
Resolution
Width and height values are now HTML-encoded when included in invocation-option form fields.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.