{"id":"GO-2026-6139","revision":"a41852e96ea042a8a18631099f2a54d6","records":[{"revision":"a41852e96ea042a8a18631099f2a54d6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6139","aliases":["CVE-2026-54735","GHSA-4p3g-4hcj-wpvx"],"title":"Server-side request forgery in bidder adapters in github.com/prebid/prebid-server/v4","description":"In github.com/prebid/prebid-server/v4 before 4.4.0, multiple bidder adapters (acuityads, bidmachine, relevantdigital, smartyads, tappx, trafficgate, zeroclickfraud) interpolate user-supplied host and subdomain parameters into outbound request URLs without validation. A remote attacker can craft bid request parameters containing path traversals or target addresses to trigger server-side request forgery (SSRF), sending HTTP requests to internal network services or unintended endpoints.","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-08-18T17:15:27.926496+00:00","affected":[{"ecosystem":"Go","name":"github.com/prebid/prebid-server/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/prebid/prebid-server/security/advisories/GHSA-4p3g-4hcj-wpvx","https://github.com/prebid/prebid-server/pull/4802","https://github.com/prebid/prebid-server/commit/494ac271cd4b5024df9123ef25ca3cff96390be3","https://github.com/prebid/prebid-server/releases/tag/v4.4.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6139","license":"OSV · upstream source license applies","key":"osv:GO-2026-6139","identifiers":["GO-2026-6139","CVE-2026-54735","GHSA-4p3g-4hcj-wpvx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}