VULNERABILITY INTELLIGENCE

CVE-2025-48986

CVSS score8.8 HIGH

EPSS probability0.68%

CISA KEVNot currently listed

Published2025-11-20

Last modified2026-09-26

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

Weakness classification

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Primary references

support@hackerone.com — Exploit, Issue Tracking, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Issue Tracking, Third Party Advisory