Issues

• Geo-based GDPR applicability (EEA country) is discarded by permissions: EU users' IDs sent without consent when gdpr.default_value=0

  prebid/prebid-server#5090 · Filter by author leiforion opened on Nov 5, 2026

• Unauthenticated CPU-exhaustion DoS via infinite loop in /setuid priority cookie ejector

  prebid/prebid-server#5089 · Filter by author leiforion opened on Nov 5, 2026

• Unauthenticated SSRF via zeroclickfraud host bidder param (IsSafeHost allows arbitrary internal host:port)

  prebid/prebid-server#5083 · Filter by author leiforion opened on Nov 3, 2026

• Unbounded per-account metrics registration (InfluxDB/go-metrics backend) lets unauthenticated clients exhaust memory and crash the process

  prebid/prebid-server#5082 · Filter by author leiforion opened on Nov 3, 2026

• Unbounded memory growth in rules engine module cache keyed by attacker-chosen account ID

  prebid/prebid-server#5081 · Filter by author leiforion opened on Nov 3, 2026
  1

• SSRF via request-controlled price floors fetch URL (ext.prebid.floors.floorendpoint.url)

  prebid/prebid-server#5077 · Filter by author leiforion opened on Nov 2, 2026

• Privacy scrubbers leave OpenRTB 2.6 user.eids intact under GDPR no-consent, COPPA, LMT and CCPA opt-out

  prebid/prebid-server#5076 · Filter by author leiforion opened on Nov 2, 2026

• JSON injection in Prebid Cache PUT encoder lets bidders and requesters rewrite cache writes and hijack cached creatives

  prebid/prebid-server#5075 · Filter by author leiforion opened on Nov 2, 2026

• Port PR from PBS-Java: Floxis: validate bid impression against outbound request

  auto
  prebid/prebid-server#5074 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Port PR from PBS-Java: Nexx360: declare vendor IDs for easybid, 1accord and prismassp aliases

  auto
  prebid/prebid-server#5073 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Port PR from PBS-Java: Refactoring: Rename confusing variable

  auto
  prebid/prebid-server#5072 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Port PR from PBS-Java: Yahoo Ads: Use bid.mtype and fix bid type on multi-format impressions

  auto
  prebid/prebid-server#5071 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Port PR from PBS-Java: MobileFuse: Pass imp.ext through to the MobileFuse endpoint

  auto
  prebid/prebid-server#5070 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Port PR from PBS-Java: Adapex: sync on the Floxis platform tracker

  auto
  prebid/prebid-server#5069 · Filter by author cross-repo-issue-creation opened on Nov 2, 2026

• Proposal: SharedID Edge (next step for the SharedID first-party server endpoint)

  prebid/prebid-server#5064 · Filter by author patmmccann opened on Oct 29, 2026

• Port PR from PBS-Java: Adapex: new alias of Floxis

  auto
  prebid/prebid-server#5059 · Filter by author cross-repo-issue-creation opened on Oct 27, 2026

• Port PR from PBS-Java: New adapter: HypeLab

  auto
  prebid/prebid-server#5058 · Filter by author cross-repo-issue-creation opened on Oct 27, 2026

• Port PR from PBS-Java: AdPlayx: New Adapter

  auto
  prebid/prebid-server#5057 · Filter by author cross-repo-issue-creation opened on Oct 27, 2026

• Prebid Service - Analytics Lifecycle design

  prebid/prebid-server#5054 · Filter by author karwaankit32 opened on Oct 27, 2026
  

• New Module proposal: in-process VAST validation for video bids (vastlint.validation)

  prebid/prebid-server#5048 · Filter by author aleksUIX opened on Oct 26, 2026
  4

• Port PR from PBS-Java: Smartadserver: forward placementuuid as plcmtuuid

  auto
  prebid/prebid-server#5022 · Filter by author cross-repo-issue-creation opened on Oct 6, 2026

• Port PR from PBS-Java: OpenRTB: Fix request model types and preserve missing fields

  auto
  prebid/prebid-server#5004 · Filter by author cross-repo-issue-creation opened on Sep 23, 2026
  2

• Panic in Pubmatic adapter

  bug
  prebid/prebid-server#5002 · Filter by author linux019 opened on Sep 23, 2026
  6

• US states outright prohibition of sale of precise user geo data

  prebid/prebid-server#4986 · Filter by author bsardo opened on Sep 9, 2026
  3

  

• update openrtb dependency

  PBS-Go
  prebid/prebid-server#4978 · Filter by author justadreamer opened on Sep 8, 2026