PT-2026-65831 · Unknown · Prebid-Server

CVE-2026-54735 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prebid Server versions prior to 4.4.0

Description Certain bidder adapters interpolate user-supplied parameters into outbound request URLs without proper validation of host and subdomain values. This allows a malicious actor to craft bid request parameters that force the server to send HTTP requests to unintended destinations, which could expose internal network services or sensitive server endpoints to unauthorized access.

Recommendations Update to version 4.4.0. Disable the affected bidder adapters as a temporary workaround.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-54735

GHSA-4P3G-4HCJ-WPVX

Affected Products

Prebid-Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-54735 · Security Note
• https://osv.dev/vulnerability/GHSA-4p3g-4hcj-wpvx · Vendor Advisory
• https://github.com/prebid/prebid-server/releases/tag/v4.4.0 · Note
• https://github.com/prebid/prebid-server/pull/4802 · Note
• https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx · Note
• https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3 · Note
• https://github.com/prebid/prebid-server · Note