CVE-2026-34917 is an improper authentication vulnerability (CWE-287) in Revive Adserver where session IDs generated for low-privileged web admin console users could be reused in the XML-RPC API. Since the API authentication is normally restricted to admin users, this flaw could allow an attacker to gain unauthorized access and exploit API-level vulnerabilities. The issue is mitigated by recording the session context (web or API) along with session data, preventing session IDs from being used interchangeably between the web console and API. No patch or official remediation level has been published yet.

An attacker with a low-privileged session ID could reuse it to access the XML-RPC API, which is intended only for admin users. This could lead to unauthorized access to API functions, potentially exposing sensitive operations or data. The impact is limited to confidentiality as per the CVSS vector, with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has implemented session context recording to prevent session ID reuse between web and API sessions. Until an official fix is released, monitoring for unusual API access patterns from low-privileged sessions may help detect exploitation attempts.