What is the CVSS score of EUVD-2026-50401?

EUVD-2026-50401 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Prebid Server are affected by EUVD-2026-50401?

Prebid Server (Go) versions below 4.4.0 contain a critical server-side request forgery vulnerability allowing unauthenticated attackers to force the ad server to make arbitrary HTTP requests and…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-50401?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50401. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-50401?

Within 24 hours, identify all Prebid Server deployments and confirm current versions in use. Within 7 days, upgrade all instances to Prebid Server 4.4.0 or later, prioritizing production environments. Within 30 days, audit network and application logs for suspicious outbound requests from ad server processes, implement egress filtering to restrict ad server network access to approved endpoints, and validate all bidder adapter configurations for custom host parameters.

Prebid Server EUVD-2026-50401

| CVE-2026-54735 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-29 https://github.com/prebid/prebid-server

GHSA-4p3g-4hcj-wpvx

Authentication Bypass SSRF Suse

10.0

CVSS 3.1 · Vendor: https://github.com/prebid/prebid-server

Severity by source

Vendor (https://github.com/prebid/prebid-server) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.3 CRITICAL

Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) with scope change into internal systems (S:C); confidentiality high from data extraction, integrity only low, availability not demonstrated - so vendor I:H/A:H is overstated.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

SUSE

CRITICAL

qualitative

Primary rating from Vendor (https://github.com/prebid/prebid-server).

CVSS VectorVendor: https://github.com/prebid/prebid-server

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 29, 2026 - 16:16 vuln.today

Analysis Generated

Jul 29, 2026 - 16:16 vuln.today

CVE Published

Jul 29, 2026 - 16:00 github-advisory

CRITICAL 10.0

DescriptionCVE.org

Impact

Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access.

Patches

Patched in v4.4.0

Workarounds

If one is unable to update, please make sure that the affected bidder adapters are disabled.

AnalysisAI

Server-side request forgery in Prebid Server (Go) versions before 4.4.0 lets remote unauthenticated attackers coerce the ad server into making HTTP requests to attacker-chosen destinations. Multiple bidder adapters (e.g. acuityads, adhese, bidmachine) interpolate an unvalidated user-supplied 'host'/'account' bid-request parameter directly into outbound URLs, enabling extraction of host-environment data and access to internal network services. No public exploit identified at time of analysis, but the fix commit and GHSA advisory are public; EPSS was not provided.

Technical ContextAI

Prebid Server is the server-side component of the Prebid header-bidding stack, written in Go and distributed as the module github.com/prebid/prebid-server. Its architecture proxies incoming OpenRTB bid requests out to many third-party bidder 'adapters,' each of which builds an outbound endpoint URL. The root cause is CWE-918 (Server-Side Request Forgery): several adapters take a client-controlled field from imp.ext.bidder (such as 'host' in acuityads/bidmachine or 'account' in adhese) and splice it into the target URL without validating that it is a bare hostname. The patch (PR #4802, commit 494ac27) introduces a shared util/urlutil.IsSafeHost check that rejects values containing paths, schemes, credentials, extra ports, or query/fragment characters (e.g. '//evil.com', 'https://host.com', 'host/path', 'user@host'), forcing inputs to be plain host[:port] tokens.

RemediationAI

Vendor-released patch: upgrade to Prebid Server v4.4.0 (https://github.com/prebid/prebid-server/releases/tag/v4.4.0), which adds the util/urlutil.IsSafeHost validation via PR #4802 (commit 494ac271cd4b5024df9123ef25ca3cff96390be3). Users on the v3, v2, or legacy 0.x module paths have no fixed release identified and should migrate to the v4.4.0 line; if that is not immediately possible, apply the documented workaround: disable the affected bidder adapters (those accepting user-supplied host/account parameters, e.g. acuityads, adhese, bidmachine) in the Prebid Server configuration, accepting the trade-off that bids from those demand partners will be lost. As an additional compensating control, place Prebid Server behind egress filtering that restricts outbound connections to a known allowlist of legitimate bidder endpoints and blocks access to internal/link-local ranges (e.g. 169.254.169.254, RFC1918), which limits SSRF reach at the cost of maintaining the allowlist. Advisory: https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx.