CVE-2025-55129

Dec. 2, 2025, 7:15 p.m.

5.4
Medium

Description

HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne users, such as itz_hari_ and khoof.

Product(s) Impacted

Product Versions
revive_adserver
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-176
Improper Handling of Unicode Encoding
The product does not properly handle when an input contains Unicode encoding.

References

https://hackerone.com/reports/3434156

Tags

support@hackerone.com
CWE-176
2025-12-02
CVE-2025-55129

CVSS Score

5.4 / 10

CVSS Data - 3.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: NONE

    • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

    View Vector String

Timeline

Published: Dec. 2, 2025, 2:15 a.m.
Last Modified: Dec. 2, 2025, 7:15 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

support@hackerone.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.