User Parameter Handling Flaw in Prebid Server Java Affects Bidder Adapters

CVE-2026-54734

What is CVE-2026-54734?

A critical security issue has been identified in Prebid Server Java that enables malicious actors to exploit user-supplied parameters. The flaw allows attackers to manipulate outbound request URLs without proper validation of the resulting domain or path segment. This could lead the server to inadvertently send HTTP requests to unauthorized destinations, potentially breaching internal network services, accessing sensitive metadata endpoints, or reaching other critical server resources. The vulnerability has been addressed in version 3.43.0, where enhanced validation of bid-request parameters ensures that such exploits are mitigated.

References