CVE-2026-54734

Name of the Vulnerable Software and Affected Versions Prebid Server Java versions prior to 3.43.0

Description Certain bidder adapters interpolate user-supplied parameters into outbound request URLs without utilizing HttpUtil to validate the resulting domain or path segment. This allows a malicious actor to supply bid-request parameters that force the server to send HTTP requests to unintended destinations. This could enable access to internal network services, metadata endpoints, or other sensitive server endpoints using the server's own network access, potentially leading to host environment data extraction.

Recommendations Update to version 3.43.0.