prebid-server-java vulnerabilities

Latest prebid-server-java CVEs

Newest publication first

1. CVE-2026-54734 Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction

   Published 2026-09-17

   Critical·CVSS 10.0 EPSS 0.62%

   Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.