Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54588— Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Quick assessment

Affected
poweradmin poweradmin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

poweradmin poweradmin是poweradmin个人开发者的一款服务器系统管理软件。 Poweradmin 4.2.4之前版本和4.3.0版本至4.3.3之前版本存在输入验证错误漏洞，该漏洞源于在OIDC、SAML和登出认证流程中将HTTP_HOST请求标头作为构建回调URL的权威来源，可能导致未经身份验证的攻击者利用此漏洞将redirect_uri发送给身份提供商，从而将受害者的授权代码重定向到攻击者控制的服务器，导致完全账户接管。

CVSS 9.6 · Critical EPSS 0.54% · P45

Possible ATT&CK Techniques 1 AI

T1133 · External Remote Services

Affected Version Matrix 2

VendorProduct Version RangeStatus
poweradmin poweradmin < 4.2.4 affected
>= 4.3.0, < 4.3.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54588

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Source: CVE Program / CVE List V5
Vulnerability Description
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
poweradmin 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
poweradmin poweradmin是poweradmin个人开发者的一款服务器系统管理软件。 Poweradmin 4.2.4之前版本和4.3.0版本至4.3.3之前版本存在输入验证错误漏洞，该漏洞源于在OIDC、SAML和登出认证流程中将HTTP_HOST请求标头作为构建回调URL的权威来源，可能导致未经身份验证的攻击者利用此漏洞将redirect_uri发送给身份提供商，从而将受害者的授权代码重定向到攻击者控制的服务器，导致完全账户接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
poweradmin poweradmin < 4.2.4 -

II. Public POCs for CVE-2026-54588

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54588

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-54588 (1)

Vendor Pages for CVE-2026-54588 (2)

IV. Related Vulnerabilities

Same product: poweradmin
Same vendor: poweradmin
Same weakness: CWE-20