CVE-2026-54588 Details
Description
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.
A critical vulnerability exists in Poweradmin versions prior to 4.2.4 and 4.3.3, where the application improperly uses the attacker-controlled 'HTTP_HOST' header to build callback URLs for OIDC, SAML, and logout authentication processes. This lack of validation allows an unauthenticated attacker to manipulate the 'redirect_uri' sent to the Identity Provider, redirecting the victim's authorization code to an attacker-controlled server and enabling full account takeover without requiring credentials. The issue arises because the application constructs URLs from 'HTTP_HOST' without validation, relying on client-supplied data that can be easily spoofed.
Users are advised to update Poweradmin to version 4.2.4 or 4.3.3, where this vulnerability has been patched. For immediate mitigation, set the 'interface.base_url' in the Poweradmin configuration file to activate the safe branch in the SAML configuration service.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4 | [email protected] | Release NotesVendor |
| https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3 | [email protected] | Release NotesVendor |
| https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Poweradmin | < 4.2.4 (semver) >= 4.3.0, < 4.3.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |