Skip to content
Threat Feed
Subscribe

Product

Poweradmin (>= 4.3.0, < 4.3.3)

1 brief RSS
medium advisory

Poweradmin Vulnerable to Host Header Injection in Authentication Redirects

Poweradmin versions earlier than 4.2.4 and from 4.3.0 up to, but not including, 4.3.3 are vulnerable to CVE-2026-54588, a critical Host Header Injection flaw in OIDC, SAML, and logout authentication flows that allows an unauthenticated attacker to manipulate the HTTP_HOST header, poisoning callback URLs to redirect authorization codes to an attacker-controlled server, leading to full account takeover and potential full DNS zone control.

Poweradmin +1 web-vulnerability host-header-injection oidc saml account-takeover dns-hijacking
3t 1c 1i