CVE-2026-54588: Poweradmin Host Header Poisoning in OIDC and SAML Callbacks
Poweradmin versions before 4.2.4 and 4.3.3 build OIDC, SAML and logout callback URLs from the HTTP Host request header without validation, and the header is controlled by the requester. The record states that an unauthenticated attacker could redirect authorization codes to a server they control, leading to full account takeover. Versions 4.2.4 and 4.3.3 patch the issue.
Overview
Poweradmin is a web-based DNS administration tool for the PowerDNS server. According to the advisory text in the record, versions before 4.2.4 and 4.3.3 take the HTTP Host request header as the basis for building callback URLs in OIDC, SAML and logout flows, without validating it. The vendor advisory is available at GHSA-3735-5339-xfwx.
Impact
- The record describes a path in which an unauthenticated remote attacker can influence the redirect_uri sent to the Identity Provider, causing the authorization code of a victim to be delivered to an attacker-controlled server.
- The record describes the result as full account takeover without credentials.
- The CVSS 3.1 base score in the record is 9.6 (critical), with network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact.
Affected products and versions
- Poweradmin versions prior to 4.2.4 and prior to 4.3.3, as stated in the record description.
- The structured affected-products list in the record is empty, so exact boundaries should be checked against the vendor advisory and release 4.2.4 and release 4.3.3.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade Poweradmin to version 4.2.4 or 4.3.3, which the record states patch the issue.
- Until upgrading is possible, limit which host names reach the application at the reverse proxy or web server, accepting only the expected canonical hostname. This is a general hardening measure and is not stated as a vendor fix.
- Review the registered redirect URIs and allowed callback lists on the Identity Provider, so that unexpected destinations are refused.
- Review the Poweradmin OIDC, SAML and logout configuration after upgrading.
Detection guidance
- Review web server and application logs for requests to authentication and logout endpoints that carry unexpected or unrecognized Host header values.
- Monitor Identity Provider logs for authorization requests with redirect URIs that do not match the registered application callbacks.
- Watch for unexpected sign-in activity on administrative accounts that use Poweradmin.
Limitations of the available information
- The record contains no EPSS or SSVC data, so likelihood scoring is unknown.
- The structured affected and fixed version fields are empty; version information is taken from the record description and the referenced release pages.
- Whether any attack has occurred in practice is unknown from the available sources.
- Deployment details, such as whether a reverse proxy already normalizes the Host header, are not described in the record.
Frequently asked questions
What is the core problem in CVE-2026-54588?
According to the record, Poweradmin builds OIDC, SAML and logout callback URLs from the HTTP Host header without validating it, so the requester can influence the redirect_uri sent to the Identity Provider.
Which versions are fixed?
The record states that versions 4.2.4 and 4.3.3 patch the issue, and that versions before those releases are affected.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.