PT-2025-48188 · Unknown · Revive Adserver

Kassem S · Published 2025-11-26 · Updated 2025-12-30 · CVE-2025-55129

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver (affected versions not specified)

Description The software contains a flaw in username validation that allows anyone to register look-alike accounts and impersonate administrators. This issue persists after a previous fix for CVE-2025-52672, with impersonation possible through several alternate techniques, including homoglyphs. The vulnerability could indirectly impact over 1–10 million users through ad-delivery chains across thousands of installations worldwide. The issue involves handling of usernames, potentially allowing malicious actors to create accounts that visually resemble legitimate administrator accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-176

Related Identifiers

CVE-2025-55129

Affected Products

Revive Adserver

References · 9

• 🔥 https://hackerone.com/reports/3434156 · Exploit
• https://osv.dev/vulnerability/CVE-2025-55129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55129 · Security Note
• https://t.me/cveNotify/144483 · Telegram Post
• https://twitter.com/kassem_S94/status/1995763711709970460 · Twitter Post
• https://t.me/cveNotify/147138 · Telegram Post
• https://twitter.com/CVEnew/status/1995688550616969489 · Twitter Post
• https://twitter.com/VolerionSec/status/1995680422496227411 · Twitter Post
• https://twitter.com/kassem_S94/status/1993720879197393049 · Twitter Post