Prebid Server EUVD-2026-50401

Exploitation requires that the Prebid Server instance have at least one affected bidder adapter enabled - specifically adapters that accept a user-controlled 'host' (acuityads, bidmachine) or 'account' (adhese) parameter and splice it into the outbound request URL - and that the attacker can submit bid requests reaching that adapter. The malicious value must be an absolute-URL-style or path/scheme/credential-bearing string (e.g. '//evil.com', 'https://host.com', 'host/path', 'user@host', or an internal host) rather than a bare hostname; the v4.4.0 IsSafeHost check that rejects such values is exactly what closes the hole. Limiting factors: only deployments running the vulnerable adapters are exposed (installs that disable them are not), the impact is primarily internal-service exposure/data extraction rather than code execution, and versions on the v2/v3/0.x paths have no fixed release, forcing a migration rather than a point upgrade.

The vendor CVSS is 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a network-reachable, unauthenticated, low-complexity SSRF with a scope change into internal systems. That maximum score appears inflated on the integrity and availability axes: the advisory describes 'host environment data extraction' and unauthorized access to internal endpoints, which is primarily a confidentiality/exposure impact, with only limited integrity effect and no clear availability impact - so treat I:H/A:H with skepticism and prioritize based on confidentiality/internal-exposure risk. No EPSS score, KEV listing, or public PoC was provided, so exploitation likelihood signals are absent; this is a fix-driven disclosure rather than an observed-in-the-wild event. Net: a genuinely high-priority issue for anyone running affected adapters (unauthenticated network SSRF with scope change), but the 'perfect 10' should be read as vendor conservatism, not evidence of RCE or destructive impact. Note the input's 'Authentication Bypass' tag is not supported by the SSRF description and CVSS vector - verify with vendor before treating auth-bypass as a separate capability.

An attacker with the ability to submit bid requests to a public Prebid Server endpoint crafts an imp.ext.bidder object for an affected adapter, setting host/account to a value like 'evil.com/path?redirect=http://attacker.com#' or an internal address. The server interpolates this into its outbound adapter URL and issues the request, letting the attacker reach internal services or cloud metadata endpoints and exfiltrate host-environment data. Given AV:N/AC:L/PR:N, this requires only network access and no authentication; no public PoC is confirmed, though the patch's test cases illustrate the malicious inputs.