Prebid Server allows certain bidder adapters to interpolate user‑supplied parameters into outbound request URLs without validating the host or subdomain. This flaw can be triggered by a crafted bid request, causing the server to make requests to arbitrary internal or external destinations and potentially leak sensitive data. The vulnerability is a classic server‑side request forgery (CWE‑918) and can lead to disclosure of internal network services or confidential server endpoints.

The vulnerability impacts installations of Prebid Server prior to version 4.4.0. Users of the open‑source real‑time advertising auction platform should verify whether their deployments include any bidder adapters that perform URL interpolation as described, and check that the deployed version is older than 4.4.0.

The CVSS score of 10 indicates the greatest severity, and the EPSS score of less than 1% suggests limited current exploitation activity, though the flaw remains exploitable. The vulnerability is not listed in the CISA KEV catalog, but it still permits internal data exposure. Attackers with the ability to influence bid request parameters can trigger unintended outbound requests, leading to potential data leakage or further lateral movement within the host environment.