https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T06:33:29.640438+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-329761 EUVD-2026-329761 2026-10-08T06:33:29.642662+00:00 EUVD-2026-329761 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54588 fkie_cve-2026-54588 2026-10-08T06:33:29.642693+00:00

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

 https://cve.radiocsirt.org/vuln/ghsa-3735-5339-xfwx GHSA-3735-5339-xfwx — Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. 2026-10-08T06:33:29.642728+00:00

Affected: Packagist: poweradmin/poweradmin

### Summary Poweradmin v4.3.2 uses the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required.

Three independent code paths are affected:

- **Primary (Critical):** `OidcService::getCallbackUrl()` - `redirect_uri` poisoning - **Secondary (High):** `SamlConfigurationService::getBaseUrl()` - SAML ACS/SLO URL poisoning - **Tertiary (Medium):** `LogoutController::getBaseUrl()` - post-logout redirect poisoning

### Details

***Root Cause***

The application constructs absolute URLs dynamically from `HTTP_HOST` rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow.

Poweradmin's own codebase contains the correct pattern - `DocsController::getValidatedHost()` (line 244) calls `isValidHostname()` before using the value - but this was never applied to authentication flows.

### Primary: `lib/Application/Service/OidcService.php` (~line 460)

```php private function getCallbackUrl(): string { $scheme = $this->detectScheme(); // HTTP_HOST taken directly with zero validation $hos…