DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54735: CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters

#security #cve #cybersecurity

CVE-2026-54735: Critical Server-Side Request Forgery (SSRF) in Prebid Server Bidder Adapters

Vulnerability ID: CVE-2026-54735
CVSS Score: 10.0
Published: 2026-07-29

CVE-2026-54735 is a critical Server-Side Request Forgery (SSRF) vulnerability in Prebid Server's bidder adapters, allowing unauthenticated remote attackers to route HTTP requests to arbitrary locations, including internal local host loopbacks and cloud provider metadata endpoints.

TL;DR

Prebid Server versions prior to 4.4.0 fail to validate or sanitize dynamic host and subdomain parameters within several bidder adapters. This allows unauthenticated remote attackers to manipulate the destination of outbound HTTP requests by supplying control characters in OpenRTB requests.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v3.1: 10.0 (Critical)
  • Exploit Status: Proof of Concept available
  • CISA KEV Status: Not listed
  • Impact: Server-Side Request Forgery, Local Host Enumeration, Credential Disclosure

Affected Systems

  • Prebid Server
  • prebid-server: < 4.4.0 (Fixed in: 4.4.0)

Code Analysis

Commit: 494ac27

Validate host and subdomain bidder params in Go and JSON schemas

Exploit Details

  • GitHub security advisory test cases: JSON test vectors demonstrating invalid-host.json and invalid-account.json structures used to verify the fixes in AcuityAds and Adhese adapters.

Mitigation Strategies

  • Upgrade to Prebid Server version 4.4.0 or above
  • Configure outbound egress firewalls to block private IP ranges (RFC 1918) and link-local addresses
  • Implement DNS resolution filters inside the container network

Remediation Steps:

  1. Identify all active Prebid Server instances and map their respective current versions
  2. Execute upgrade processes to update the prebid-server image or binary to version 4.4.0 or newer
  3. Deploy updated network security policies or firewall rules to limit Prebid Server's outbound egress to public IP endpoints
  4. Verify the mitigation using test payloads matching invalid-host structures

References

Read the full report for CVE-2026-54735 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)