CVE-2026-54588: Poweradmin Auth Bypass Vulnerability

CVE-2026-54588 Overview

CVE-2026-54588 is a host header injection vulnerability in Poweradmin, a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 trust the attacker-controlled HTTP_HOST request header when building callback URLs for OpenID Connect (OIDC), Security Assertion Markup Language (SAML), and logout authentication flows. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider (IdP). The IdP then redirects the victim's authorization code to an attacker-controlled server, enabling full account takeover with no credentials required. The vulnerability is categorized as [CWE-20] Improper Input Validation.

Critical Impact
Unauthenticated attackers can hijack OIDC/SAML authorization codes through a single phishing link, gaining full administrative access to Poweradmin DNS management without stealing credentials.

Affected Products

Poweradmin versions prior to 4.2.4 (4.2.x branch)
Poweradmin versions prior to 4.3.3 (4.3.x branch)
Deployments using OIDC, SAML, or external logout authentication flows

Discovery Timeline

2026-06-23 - CVE-2026-54588 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-54588

Vulnerability Analysis

The vulnerability resides in Poweradmin's authentication callback URL construction logic. The application reads the HTTP_HOST header from incoming requests and treats it as the authoritative hostname when generating the redirect_uri parameter sent to the configured Identity Provider. Because HTTP_HOST is fully attacker-controllable, any value supplied by a malicious client is propagated into the OIDC and SAML handshake without validation against an allowlist of trusted hosts.

When a victim clicks a crafted link, the IdP authenticates the user and returns the authorization code or SAML response to the poisoned callback URL. The attacker, hosting a listener at that domain, captures the code and exchanges it for a valid session. The flaw spans login, callback, and logout endpoints, broadening the attack surface across the entire single sign-on flow.

Root Cause

The root cause is the absence of host header validation in URL generation routines for the OIDC, SAML, and logout flows. Secure implementations require either a hardcoded base URL or strict comparison against a configured allowlist before constructing IdP-bound URLs.

Attack Vector

Exploitation requires only network access to the Poweradmin login page and user interaction from a victim. An attacker sends a phishing link to a Poweradmin administrator. The crafted request carries a Host header pointing to attacker infrastructure. Poweradmin embeds that hostname in the redirect_uri sent to the IdP. After successful authentication, the IdP delivers the authorization code to the attacker, who exchanges it for an authenticated session and gains administrative control over DNS records.

No authentication code is reproduced here. Refer to the GitHub Security Advisory GHSA-3735-5339-xfwx for technical details from the maintainers.

Detection Methods for CVE-2026-54588

Indicators of Compromise

HTTP requests to Poweradmin endpoints containing Host headers that do not match the canonical deployment hostname
Outbound IdP authorization requests where the redirect_uri parameter references an unexpected or external domain
Successful administrator logins followed by unexpected DNS record modifications or zone transfers
Authentication callback traffic terminating at hosts outside the organization's documented infrastructure

Detection Strategies

Inspect web server access logs for mismatches between the Host header and the server's configured ServerName or virtual host directive
Correlate IdP audit logs with Poweradmin session events to detect redirect_uri values referencing untrusted domains
Alert on Poweradmin login activity originating from referrer URLs hosted on suspicious or newly registered domains

Monitoring Recommendations

Enable verbose logging on the upstream reverse proxy or load balancer to capture full request headers for the Poweradmin virtual host
Forward IdP authentication logs to a centralized analytics platform and flag redirect_uri values that fall outside an explicit allowlist
Monitor DNS record change events in PowerDNS for activity occurring shortly after anomalous authentication callbacks

How to Mitigate CVE-2026-54588

Immediate Actions Required

Upgrade Poweradmin to version 4.2.4 or 4.3.3, which contain the official patch
Audit IdP logs for redirect_uri parameters referencing unexpected hosts since OIDC or SAML was enabled in Poweradmin
Rotate any administrator sessions and review recent DNS zone changes for unauthorized modifications

Patch Information

The maintainers released fixes in Poweradmin v4.2.4 and Poweradmin v4.3.3. Both releases replace HTTP_HOST-derived URL construction with validated, configuration-driven base URLs across the OIDC, SAML, and logout flows.

Workarounds

Configure the web server (Apache or nginx) to reject requests whose Host header does not match the canonical Poweradmin hostname
Restrict allowed redirect_uri values at the Identity Provider to an explicit list of trusted Poweradmin callback URLs
Place Poweradmin behind a reverse proxy that overwrites the Host header to a fixed value before forwarding requests

bash

# nginx example: enforce a canonical Host header for Poweradmin
server {
    listen 443 ssl;
    server_name poweradmin.example.com;

    # Reject requests with mismatched Host headers
    if ($host != "poweradmin.example.com") {
        return 400;
    }

    location / {
        proxy_set_header Host poweradmin.example.com;
        proxy_set_header X-Forwarded-Host poweradmin.example.com;
        proxy_pass http://127.0.0.1:8080;
    }
}