What’s Vulnerable › Vulnerabilities

CVE-2026-54735: prebid-server's request forgery vulnerability allows for possible host environment data extraction

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-29 · updated 2026-10-23
• Weakness: CWE-918

Description

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

Affected products

• prebid-server: before 4.4.0 — fixed in 4.4.0

How to fix

Upgrade to a fixed version: prebid-server 4.4.0. Check the vendor advisory for mitigations.

References

• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
• https://github.com/prebid/prebid-server/pull/4802
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0
• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx

Get alerted when CVE-2026-54735 or the next vulnerability affects your stack