What is CVE-2025-48986?

CVE-2025-48986 is a high-severity vulnerability in Revive Adserver, classified under Improper Access Control. CVSS score: 8.8/10. Published 2025-11-20.

How severe is CVE-2025-48986?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Revive Adserver

CVE-2025-48986

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

EPSS: 0.006 (46.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Revive Adserver — versions 5, 5.5.3, 6.0.2
Revive-adserver Revive_adserver

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

support@hackerone.com (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2025-48986?: CVE-2025-48986 is a high-severity vulnerability in Revive Adserver, classified under Improper Access Control. CVSS score: 8.8/10. Published 2025-11-20.
How severe is CVE-2025-48986?: High severity. CVSS v3 base score is 8.8 out of 10.