The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.

Affected: unknown Revive Adserver Vulnerabilities

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-002 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-002 ------------------------------------------------------------------------ Date: 2026-06-03 Risk Level: Medium to High Applications affected: Revi…

The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129. As a result, API users could create usernames that enabled impersonation or stored XSS attacks. Proper validation has been added where it was missing.