EUVD-2026-329761

fkie_cve-2026-54588

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

GHSA-3735-5339-xfwx — Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Affected: Packagist: poweradmin/poweradmin

### Summary Poweradmin v4.3.2 uses the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required.

Three independent code paths are affected:

- **Primary (Critical):** `OidcService::getCallbackUrl()` - `redirect_uri` poisoning - **Secondary (High):** `SamlConfigurationService::getBaseUrl()` - SAML ACS/SLO URL poisoning - **Tertiary (Medium):** `LogoutController::getBaseUrl()` - post-logout redirect poisoning

### Details

***Root Cause***

The application constructs absolute URLs dynamically from `HTTP_HOST` rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow.

Poweradmin's own codebase contains the correct pattern - `DocsController::getValidatedHost()` (line 244) calls `isValidHostname()` before using the value - but this was never applied to authentication flows.

### Primary: `lib/Application/Service/OidcService.php` (~line 460)

```php private function getCallbackUrl(): string { $scheme = $this->detectScheme(); // HTTP_HOST taken directly with zero validation $hos…

Most recent entries from all

EUVD-2026-329761

fkie_cve-2026-54588

GHSA-3735-5339-xfwx — Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.