CVE-2026-54735

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

10.0 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H                                    

Vulnerability Description

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.

Vulnerability Details

Published Date

July 29, 2026

Last Modified

July 29, 2026

CWE ID

CWE-918

Source

NVD

Vendor

prebid

Product

prebid-server

External References

https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
https://github.com/prebid/prebid-server/pull/4802
https://github.com/prebid/prebid-server/releases/tag/v4.4.0
https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx

CVE-2026-54735

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment