CVE-2025-55127: aquaplatform revive_adserver Improper Neutralization of Whitespace

Vulnerability summary

CVE-2025-55127 is a medium (CVSS 5.4) Improper Neutralization of Whitespace vulnerability in aquaplatform revive_adserver. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-11-2025
   PublishedVulnerability first disclosed.
2. 20-11-2025
   Last modifiedVulnerability information updated.

Description

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the UI, potentially leading to confusion.

• CWE-156Improper Neutralization of WhitespaceThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.