BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-25

Assigner: HackerOne

Description

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-48986

EUVD

EUVD-2025-198352

Affected Vendors & Products

Vendor	Product	Version / Range
revive-adserver	revive_adserver	to 5.5.2 (inc)
revive-adserver	revive_adserver	From 6.0.0 (inc) to 6.0.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in Revive Adserver versions 5.5.2, 6.0.1, and earlier. It allows a logged-in attacker to change other users' email addresses and potentially take over their accounts by exploiting the forgot password functionality.

Impact Analysis

An attacker who exploits this vulnerability can take over other users' accounts by changing their email addresses, leading to unauthorized access, data compromise, and potential control over affected accounts.

Hi! I’m here to help you understand CVE-2025-48986. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70