CVE-2026-54588
Description
Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.
How to fix
- poweradmin/poweradmin4.2.4, 4.3.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| poweradmin/poweradminPackagist | v < 4.2.4, 4.3.0 ≤ v < 4.3.3 | 4.2.4, 4.3.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.