CVE-2026-54735CWE-918ssrf

CVE-2026-54735

Critical · published July 29, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00611 · 48.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-29T20:17Z
Affected products (1)
ProductVersionsFixed in
prebid/prebid_server< 4.4.04.4.0
References (4)
https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3 · [email protected]https://github.com/prebid/prebid-server/pull/4802 · [email protected]https://github.com/prebid/prebid-server/releases/tag/v4.4.0 · [email protected]https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx · [email protected]
EPSS history
Timeline
  • 29 JUL 15:59Z
    prebid-server's request forgery vulnerability allows for possible host environment data extraction
    cvelistv5