CVE-2026-34917_CVE-2026-34917

4.3 / 10

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.

Basic Information

ID CVE-2026-34917

Source hackerone

Published Jun 23, 2026 at 16:14

Modified Jun 23, 2026 at 17:24

Affected Product

Vendor Revive

Product Adserver

Affected Versions Revive Adserver 0

CWE Classification

CWE-287

References

hackerone.com /reports/3672641

{
    "lastseen": "",
    "description": "Low\u2011privileged session IDs generated for the web admin console could be reused in the XML\u2011RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API\u2011level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.",
    "published": "2026-06-23T16:14:38.592Z",
    "modified": "2026-06-23T17:24:49.856Z",
    "type": "cve",
    "title": "CVE-2026-34917",
    "source": "hackerone",
    "references": "https://hackerone.com/reports/3672641",
    "id": "CVE-2026-34917",
    "bulletinFamily": "",
    "cwe": [
        "CWE-287"
    ],
    "cvelist": null,
    "sourceData": "Revive Adserver 0",
    "sourceHref": "",
    "cvss": {
        "score": 4.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
        "version": "3.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Adserver",
    "version": "0",
    "vendor": "Revive",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}