CVE-2026-54588 – Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

CVE ID :CVE-2026-54588

Published : June 23, 2026, 10:09 p.m. | 1 hour, 34 minutes ago

Description :Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim’s authorization code to an attacker-controlled server – resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…