CVE-2026-54735

{
  "id": "CVE-2026-54735",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-29T16:17:54.317",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0."
    },
    {
      "lang": "es",
      "value": "Prebid Server es una solución de código abierto para ejecutar subastas de publicidad en tiempo real en la nube. Antes de la versión 4.4.0, ciertos adaptadores de postor en Prebid Server interpolan parámetros proporcionados por el usuario en URLs de solicitudes salientes sin validar correctamente los valores de host y subdominio, permitiendo que parámetros de solicitud de puja manipulados causen solicitudes del lado del servidor a destinos no deseados y potencialmente expongan servicios de red internos o puntos finales de servidor sensibles. Este problema está solucionado en la versión 4.4.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "prebid",
          "product": "prebid-server",
          "versions": [
            {
              "version": "< 4.4.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T18:04:08.706808Z",
          "id": "CVE-2026-54735",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:prebid:prebid_server:*:*:*:*:*:go:*:*",
              "versionEndExcluding": "4.4.0",
              "matchCriteriaId": "1E0ADE95-CC2A-42D3-989C-464B8DFB15B7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/prebid/prebid-server/pull/4802",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/prebid/prebid-server/releases/tag/v4.4.0",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}