github.com/prebid/prebid-server/v3
Open-source solution for running real-time advertising auctions in the cloud.
View on Github
Activity
- Latest release
- 9mo ago
- Total releases
- 31
- Cadence
- ~12 days
- Last 12 months
- 3
Reach
- Stars
- 572
Details
- First release
- Oct 31, 2024
| Version | Released | |
|---|---|---|
v3.30.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.30.0
minor
Dependencies (41)
+ 33 more |
|
v3.29.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.29.0
minor
Dependencies (41)
+ 33 more |
|
v3.28.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.28.0
minor
Dependencies (41)
+ 33 more |
|
v3.27.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.27.0
minor
Dependencies (41)
+ 33 more |
|
v3.26.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.26.0
minor
Dependencies (41)
+ 33 more |
|
v3.25.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.25.0
minor
Dependencies (41)
+ 33 more |
|
v3.24.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.24.0
minor
Dependencies (41)
+ 33 more |
|
v3.23.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.23.0
minor
Dependencies (41)
+ 33 more |
|
v3.22.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.22.0
minor
Dependencies (41)
+ 33 more |
|
v3.21.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.21.0
minor
Dependencies (40)
+ 32 more |
|
v3.20.1
patch
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.20.1
patch
Dependencies (40)
+ 32 more |
|
v3.20.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.20.0
minor
Dependencies (40)
+ 32 more |
|
v3.19.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.19.0
minor
Dependencies (40)
+ 32 more |
|
v3.18.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.18.0
minor
Dependencies (40)
+ 32 more |
|
v3.17.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.17.0
minor
Dependencies (40)
+ 32 more |
|
v3.16.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.16.0
minor
Dependencies (40)
+ 32 more |
|
v3.15.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.15.0
minor
Dependencies (40)
+ 32 more |
|
v3.14.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.14.0
minor
Dependencies (40)
+ 32 more |
|
v3.13.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.13.0
minor
Dependencies (40)
+ 32 more |
|
v3.12.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.12.0
minor
Dependencies (40)
+ 32 more |
|
v3.11.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.11.0
minor
Dependencies (40)
+ 32 more |
|
v3.10.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.10.0
minor
Dependencies (41)
+ 33 more |
|
v3.9.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.9.0
minor
Dependencies (41)
+ 33 more |
|
v3.8.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.8.0
minor
Dependencies (41)
+ 33 more |
|
v3.7.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.7.0
minor
Dependencies (41)
+ 33 more |
|
v3.6.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.6.0
minor
Dependencies (41)
+ 33 more |
|
v3.5.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.5.0
minor
Dependencies (41)
+ 33 more |
|
v3.4.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.4.0
minor
Dependencies (37)
+ 29 more |
|
v3.3.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.3.0
minor
Dependencies (37)
+ 29 more |
|
v3.2.0
minor
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.2.0
minor
Dependencies (37)
+ 29 more |
|
v3.1.0
initial
1 CVE
CVE-2026-54735
GHSA-4p3g-4hcj-wpvx
GO-2026-6139
Jul 29, 2026
prebid-server's request forgery vulnerability allows for possible host environment data extraction
10.0
/ 10
Critical
Network
Low
None
None
Changed
High
High
High
ImpactCertain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing internal network services or sensitive server endpoints to unauthorized access. PatchesPatched in v4.4.0 WorkaroundsIf one is unable to update, please make sure that the affected bidder adapters are disabled. References
Updated Aug 18, 2026 · Source: OSV.dev |
v3.1.0
initial
Dependencies (37)
+ 29 more |