A flaw in Revive Adserver 6.0.7 allows an attacker to bypass the admin‑only restriction on its XML‑RPC API. The ox.login method returns a session ID cookie even when the login fails, and the session is not invalidated. An adversary can capture that cookie and then use it to make subsequent API calls without any administrative credentials, potentially altering ad configuration or harvesting data. The weakness is a form of insufficient access control (CWE‑284).

The product affected is Revive Adserver 6.0.7, provided by Revive:Adserver. No other versions or additional vendors are listed.

The CVSS score of 4.3 indicates a low severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation at present. Nevertheless, the attack can be performed remotely by sending a malformed ox.login request to the XML‑RPC endpoint, inferred from the description; the attacker then captures the returned session cookie and re‑uses it for privileged API calls. This makes the vulnerability a low‑to‑moderate risk, with the potential for serious impact if an attacker successfully gains unauthorized API access.