CRITICAL 10.0 NVD
CVE-2026-54735
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Serv
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.
References
- https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3
- https://github.com/prebid/prebid-server/pull/4802
- https://github.com/prebid/prebid-server/releases/tag/v4.4.0
- https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-07-29 via NVD.
Risk Timeline
CVE Disclosed2026-07-29 · 5 days ago
Remediation Resources
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.