CVE-2026-54735 affects Prebid Server, an open-source real-time advertising auction platform. Prior to version 4.4.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values. This flaw allows attackers to craft malicious bid request parameters that trigger server-side requests to unintended destinations, a classic Server-Side Request Forgery (SSRF) vulnerability. Exploitation could expose internal network services or sensitive server endpoints. The vulnerability has been patched in Prebid Server version 4.4.0. A corresponding GitHub security advisory (GHSA-4p3g-4hcj-wpvx) and pull request (#4802) have been published. Users are strongly advised to upgrade to v4.4.0 or later to mitigate this risk.