What is the CVSS score of CVE-2026-54588?

CVE-2026-54588 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Poweradmin are affected by CVE-2026-54588?

Poweradmin versions prior to 4.2.4 and 4.3.3 are vulnerable to account takeover attacks that completely bypass identity provider authentication and grant attackers full account access without any…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54588?

Yes, a public proof-of-concept exploit is available for CVE-2026-54588. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-54588?

Within 24 hours: Identify all Poweradmin deployments, current versions, and count of affected users; assess which systems use OIDC or SAML authentication. Within 7 days: Implement interim mitigations including strict HTTP Host header validation at the application and WAF level, restrict redirect_uri allowlists to legitimate domains only, and mandate multi-factor authentication. Within 30 days: Upgrade all instances to Poweradmin 4.2.4+ (for 4.2.x branch) or 4.3.3+ (for 4.3.x branch).

Poweradmin CVE-2026-54588

EUVD-2026-38633 CRITICAL

Improper Input Validation (CWE-20)

2026-06-23 GitHub_M

GHSA-3735-5339-xfwx

Information Disclosure Poweradmin

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

vuln.today AI

9.3 CRITICAL

Network-reachable Host header poisoning, no privileges, victim click required (UI:R); scope changes to IdP identity (S:C); no availability impact so A:N rather than A:L.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 28, 2026 - 18:02 EUVD

Source Code Evidence Fetched

Jun 23, 2026 - 22:45 vuln.today

Analysis Generated

Jun 23, 2026 - 22:45 vuln.today

DescriptionCVE.org

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

AnalysisAI

Account takeover in Poweradmin versions prior to 4.2.4 and 4.3.3 allows remote unauthenticated attackers to hijack OIDC and SAML authentication flows by poisoning the HTTP Host header used to construct the redirect_uri sent to the Identity Provider. By tricking a victim into clicking a crafted login link, the attacker causes the IdP to deliver the authorization code to an attacker-controlled host, yielding full account access with no credentials required. No public exploit identified at time of analysis, though the upstream advisory and patched releases describe the issue in detail.

Technical ContextAI

Poweradmin is a PHP web-based administration interface for the PowerDNS authoritative DNS server, and the affected code paths build callback URLs for OIDC (redirect_uri and post-logout redirect), SAML (ACS, SLO, entityID), and the API docs base URL by reading the request-time HTTP_HOST header rather than a server-side configured value. This is a textbook CWE-20 Improper Input Validation issue - more specifically Host header injection feeding into trust-sensitive URL construction. Because the IdP echoes the supplied redirect_uri back to the user, an attacker who controls Host can divert federated authentication artifacts (authorization codes, SAML assertions) to infrastructure they own. The 4.2.4 release notes confirm the fix replaces the Host fallback with the operator-set interface.application_url configuration value, anchoring callback URLs server-side.

RemediationAI

Vendor-released patch: upgrade to Poweradmin 4.2.4 (https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4) or 4.3.3 (https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3), and after upgrading explicitly set interface.application_url in the configuration to the canonical externally reachable URL so callback URLs are anchored server-side rather than falling back to request data. If immediate patching is not possible, compensating controls include disabling the OIDC and SAML login providers and reverting to local authentication (trade-off: loss of SSO and any MFA enforced at the IdP), placing the Poweradmin interface behind a reverse proxy or WAF that strips or normalizes the Host header to a fixed value before it reaches PHP (trade-off: must be carefully tested so legitimate vhost routing still works), and restricting network access to the admin UI to trusted operator networks via firewall or VPN (trade-off: blocks remote operator access). See the advisory at https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx for full details.