CVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3	Patch
https://github.com/prebid/prebid-server/pull/4802	Issue Tracking Patch
https://github.com/prebid/prebid-server/releases/tag/v4.4.0	Product Release Notes
https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:prebid:prebid_server:*:*:*:*:*:go:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Prebid Server es una solución de código abierto para ejecutar subastas de publicidad en tiempo real en la nube. Antes de la versión 4.4.0, ciertos adaptadores de postor en Prebid Server interpolan parámetros proporcionados por el usuario en URLs de solicitudes salientes sin validar correctamente los valores de host y subdominio, permitiendo que parámetros de solicitud de puja manipulados causen solicitudes del lado del servidor a destinos no deseados y potencialmente expongan servicios de red internos o puntos finales de servidor sensibles. Este problema está solucionado en la versión 4.4.0.

Information

Published : 2026-07-29 16:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54735

Mitre link : CVE-2026-54735

CVE.ORG link : CVE-2026-54735

JSON object : View

Products Affected

prebid

prebid_server

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-54735", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54735", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T18:04:08.706808Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "prebid", "product": "prebid-server", "versions": [{"status": "affected", "version": "< 4.4.0"}]}]}], "published": "2026-07-29T16:17:54.317", "references": [{"url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/prebid/prebid-server/pull/4802", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."}, {"lang": "es", "value": "Prebid Server es una soluci\u00f3n de c\u00f3digo abierto para ejecutar subastas de publicidad en tiempo real en la nube. Antes de la versi\u00f3n 4.4.0, ciertos adaptadores de postor en Prebid Server interpolan par\u00e1metros proporcionados por el usuario en URLs de solicitudes salientes sin validar correctamente los valores de host y subdominio, permitiendo que par\u00e1metros de solicitud de puja manipulados causen solicitudes del lado del servidor a destinos no deseados y potencialmente expongan servicios de red internos o puntos finales de servidor sensibles. Este problema est\u00e1 solucionado en la versi\u00f3n 4.4.0."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:prebid:prebid_server:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "1E0ADE95-CC2A-42D3-989C-464B8DFB15B7", "versionEndExcluding": "4.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}