SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-54735

CRITICAL · CVSS 10 EPSS 0.34% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-29 · Last synced 2026-08-28

CyberRota Analysis

AI-Generated

Certain bidder adapters in Prebid Server prior to version 4.4.0 are vulnerable due to improper validation of user-supplied parameters, which can lead to server-side requests being sent to unintended destinations. This critical vulnerability could expose internal network services and sensitive endpoints, posing significant risks to data integrity and confidentiality. Organizations using Prebid Server should prioritize upgrading to version 4.4.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54735
Severity
CRITICAL
CVSS
10
EPSS
0.34%

Original NVD Description

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafted bid request parameters to cause server-side requests to unintended destinations and potentially expose internal network services or sensitive server endpoints. This issue is fixed in version 4.4.0.