{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/poweradmin--4.3.0--4.3.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-54588"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Poweradmin (\u003c 4.2.4)","Poweradmin (\u003e= 4.3.0, \u003c 4.3.3)"],"_cs_severities":["medium"],"_cs_tags":["web-vulnerability","host-header-injection","oidc","saml","account-takeover","dns-hijacking"],"_cs_type":"advisory","_cs_vendors":["Poweradmin"],"content_html":"\u003cp\u003eA critical Host Header Injection vulnerability, tracked as CVE-2026-54588, has been identified in Poweradmin versions prior to 4.2.4 and from 4.3.0 through 4.3.2. This flaw arises because Poweradmin dynamically constructs callback URLs for its OpenID Connect (OIDC), SAML, and logout authentication processes using the attacker-controlled \u003ccode\u003eHTTP_HOST\u003c/code\u003e request header without proper validation. An unauthenticated attacker can exploit this by sending a specially crafted request with a spoofed \u003ccode\u003eHost\u003c/code\u003e header, causing the Identity Provider (IdP) to redirect a victim's authorization code to an attacker-controlled server. This enables full account takeover without requiring credentials. If the compromised Poweradmin account possesses administrative privileges, attackers can gain full control over DNS zones, leading to severe consequences such as MX hijacking, SPF/DKIM manipulation, subdomain takeovers, and SSL certificate theft.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a vulnerable Poweradmin instance (version \u0026lt; 4.2.4 or \u0026gt;= 4.3.0 and \u0026lt; 4.3.3).\u003c/li\u003e\n\u003cli\u003eAttacker crafts an HTTP request to Poweradmin, spoofing the \u003ccode\u003eHost\u003c/code\u003e header (e.g., \u003ccode\u003eHost: attacker.com\u003c/code\u003e) and potentially \u003ccode\u003eX-Forwarded-Proto\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePoweradmin's OIDC service (\u003ccode\u003eOidcService::getCallbackUrl()\u003c/code\u003e), or SAML/Logout services, uses the spoofed \u003ccode\u003eHost\u003c/code\u003e header to construct a malicious \u003ccode\u003eredirect_uri\u003c/code\u003e (e.g., \u003ccode\u003ehttp://attacker.com/oidc/callback\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003ePoweradmin then initiates an OAuth 2.0 authorization request, redirecting the victim's browser to the legitimate Identity Provider (IdP) with the malicious \u003ccode\u003eredirect_uri\u003c/code\u003e embedded.\u003c/li\u003e\n\u003cli\u003eThe victim authenticates successfully with the IdP.\u003c/li\u003e\n\u003cli\u003eThe IdP, trusting the \u003ccode\u003eredirect_uri\u003c/code\u003e provided by Poweradmin, redirects the victim's authorization code to the attacker-controlled server (e.g., \u003ccode\u003eattacker.com/oidc/callback\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker's server captures the authorization code and exchanges it with the IdP for an access token.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the stolen access token to gain full authenticated access to the victim's Poweradmin account, achieving full account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe direct impact of this vulnerability is full account takeover of any user in Poweradmin by an unauthenticated attacker. This requires no prior credentials, malware, or existing access. In configurations where Poweradmin serves as the DNS management system, a compromised administrator account grants full control over DNS zones. This can lead to critical consequences, including MX record hijacking (redirecting all inbound email to attacker's servers for intercepting password resets and 2FA codes), manipulation of SPF/DKIM records (enabling spoofed, cryptographically authenticated emails), subdomain takeovers, and SSL certificate theft. The CVSS 3.1 score ranges from 8.2 (High) for standard deployments to 9.3 (Critical) if a misconfigured reverse proxy propagates the spoofed host header.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch CVE-2026-54588 by upgrading Poweradmin to version 4.2.4 or 4.3.3 or newer.\u003c/li\u003e\n\u003cli\u003eAs an immediate mitigation for CVE-2026-54588, set the \u003ccode\u003einterface.base_url\u003c/code\u003e parameter in \u003ccode\u003econfig/settings.php\u003c/code\u003e to your legitimate Poweradmin URL. This activates a safe branch in \u003ccode\u003eSamlConfigurationService\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement filtering or validation of the \u003ccode\u003eHost\u003c/code\u003e header at the web server or reverse proxy level to ensure it only accepts requests for expected domain names, especially for applications like Poweradmin that handle authentication.\u003c/li\u003e\n\u003cli\u003eBlock the indicator \u003ccode\u003eattacker.com\u003c/code\u003e at your network perimeter, including DNS resolvers, web application firewalls, and proxy servers.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T16:41:25Z","date_published":"2026-07-28T16:41:25Z","id":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-host-header-injection/","summary":"Poweradmin versions earlier than 4.2.4 and from 4.3.0 up to, but not including, 4.3.3 are vulnerable to CVE-2026-54588, a critical Host Header Injection flaw in OIDC, SAML, and logout authentication flows that allows an unauthenticated attacker to manipulate the HTTP_HOST header, poisoning callback URLs to redirect authorization codes to an attacker-controlled server, leading to full account takeover and potential full DNS zone control.","title":"Poweradmin Vulnerable to Host Header Injection in Authentication Redirects","url":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-host-header-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Poweradmin (\u003e= 4.3.0, \u003c 4.3.3)","version":"https://jsonfeed.org/version/1.1"}