Log in Start free

Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-54588Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Critical 9.6

In plain English

A critical-severity improper input validation in poweradmin from poweradmin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.5%top 54.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistpoweradmin/poweradmin4.2.4GHSA-3735-5339-xfwx
Packagistpoweradmin/poweradmin4.3.3GHSA-3735-5339-xfwx

Affected products (as reported)

VendorProductVersions
poweradmin poweradmin < 4.2.4>= 4.3.0, < 4.3.3

Weakness: CWE-20, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

References