rootpwn

critical · CVSS v3 10

CVE-2026-54734

Prebid Server Java prior to version 3.43.0 contains a Server-Side Request Forgery vulnerability in specific bidder adapters. The issue occur

Overview

Prebid Server Java prior to version 3.43.0 contains a Server-Side Request Forgery vulnerability in specific bidder adapters. The issue occurs when user-supplied bid-request parameters are improperly interpolated into outbound request URLs without validation. This matters because it allows unauthorized network access to internal resources and sensitive endpoints.

Description

Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network services, metadata endpoints, or other sensitive server endpoints with the server's network access. This issue is fixed in version 3.43.0.

Impact

This vulnerability impacts confidentiality, integrity, and availability by allowing unauthorized internal network access via the server. Organizations running vulnerable server instances risk exposure of internal services, cloud metadata endpoints, and sensitive backend infrastructure. System administrators and hosting environments of the Prebid Server Java application are directly affected.

Remediation

Upgrade Prebid Server Java to version 3.43.0 or later where proper domain and path validation using HttpUtil is implemented. Implement strict network egress filtering and outbound firewall rules from the Prebid Server hosts to prevent unauthorized access to internal network segments and metadata endpoints.

Risk context

The vulnerability is rated as critical with a CVSS v3 score of 10.0, indicating maximum severity due to potential full Server-Side Request Forgery capabilities. Organizations should prioritize patching immediately to eliminate the exposure window.

Affected products

  • Prebid Server Java

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
—
EPSS
—

SSRF Prebid Server Java CVSS 10.0 Server-Side Request Forgery Outbound Request Validation Network Egress Filtering

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis