CVE-2026-54735
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Prebid Server before version 4.4.0 has a vulnerability in certain bidder adapters that interpolate user-supplied parameters into outbound request URLs without proper validation of host and subdomain values. This can cause requests to unintended destinations.
Risk Assessment
An attacker can use the server to scan internal network services or expose sensitive endpoints, compromising internal network security.
Recommendation
Update Prebid Server to version 4.4.0 or later, which includes parameter validation fixes.
Original NVD description (English source)
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.