Server-side request forgery in Prebid Server bidder adapters (CVE-2026-54735)

Certain bidder adapters in Prebid Server accept user-supplied parameters that are interpolated into outbound request URLs without proper input validation. A malicious actor can craft bid request parameters to cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. Public POC available. Affected versions: - < 4.4.0 We recommend updating to: 4.4.0. CVSS 10.0 · our assessment: act_now Reference: https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx Details: https://vuln.today/cve/CVE-2026-54735