Executive brief
Prebid Server, an open-source platform for managing real-time digital advertising auctions, contains a vulnerability in how it handles certain bidder requests. An attacker could provide specially crafted parameters that force the server to send requests to unintended internal or external locations. This could allow an unauthorized party to access sensitive internal data, probe private network services, or disrupt operations.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Prebid Server versions prior to 4.4.0 due to insufficient validation of user-supplied host and subdomain parameters within specific bidder adapters. The affected adapters (including AcuityAds, Adhese, Bidmachine, and others) interpolate these parameters directly into outbound request URLs. A remote, unauthenticated attacker can exploit this by submitting crafted bid requests to trigger outbound connections to arbitrary destinations. This can be used to bypass network firewalls, access internal metadata services, or interact with sensitive internal endpoints. The vulnerability is addressed in version 4.4.0 by implementing strict host validation via the urlutil.IsSafeHost check.
Affected products
- Prebid Prebid Server < 4.4.0
Timeline
- 2026-05-28: disclosed: Initial pull request and fix development started
- 2026-06-05: patched: Version 4.4.0 released with security fixes
- 2026-07-29: advisory: CVE-2026-54735 published to NVD