{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/poweradmin/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Poweradmin \u003e= 4.1.0, \u003c 4.2.5","Poweradmin \u003e= 4.3.0, \u003c 4.3.4"],"_cs_severities":["high"],"_cs_tags":["account-takeover","oidc","vulnerability","web-application","poweradmin"],"_cs_type":"advisory","_cs_vendors":["Poweradmin"],"content_html":"\u003cp\u003eA high-severity vulnerability has been identified in Poweradmin, an open-source web-based management tool for PowerDNS. This flaw, tracked in GHSA-cmwh-g2h8-c222, allows an unauthenticated attacker to bypass OIDC identity collation, leading to account takeover. The issue stems from Poweradmin's use of a case- and accent-insensitive MySQL collation (\u003ccode\u003eutf8mb4_unicode_ci\u003c/code\u003e) for storing and matching OIDC subject identifiers (\u003ccode\u003eoidc_subject\u003c/code\u003e). An attacker can create an OIDC account with a subject that is a collation variant of a legitimate victim's subject (e.g., \u003ccode\u003evictim-login\u003c/code\u003e vs. \u003ccode\u003evictím-login\u003c/code\u003e). When the attacker attempts to authenticate, Poweradmin's database lookup, performed under the weak collation, incorrectly matches the attacker's subject to the victim's existing \u003ccode\u003euser_id\u003c/code\u003e, granting the attacker an authenticated session to the victim's Poweradmin account. The vulnerability affects Poweradmin versions 4.1.0 through 4.2.4 and 4.3.0 through 4.3.3, and it has been fixed in versions 4.2.5, 4.3.4, and 4.4.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA legitimate victim links their OIDC account with Poweradmin; Poweradmin stores the victim's OIDC \u003ccode\u003esub\u003c/code\u003e (e.g., \u003ccode\u003evictim-login\u003c/code\u003e) in the \u003ccode\u003eoidc_user_links\u003c/code\u003e table with a \u003ccode\u003eutf8mb4_unicode_ci\u003c/code\u003e collation.\u003c/li\u003e\n\u003cli\u003eAn attacker creates an OIDC account at the same OIDC provider with a \u003ccode\u003esub\u003c/code\u003e identifier that is a collation variant of the victim's \u003ccode\u003esub\u003c/code\u003e (e.g., \u003ccode\u003evictím-login\u003c/code\u003e), exploiting the accent-insensitive nature of the collation.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates an OIDC login to Poweradmin by accessing \u003ccode\u003e/oidc/login?provider=generic\u003c/code\u003e and authenticates with their attacker OIDC credentials (\u003ccode\u003evictím-login\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003ePoweradmin receives the attacker's OIDC \u003ccode\u003esub\u003c/code\u003e (\u003ccode\u003evictím-login\u003c/code\u003e) from the OIDC provider's userinfo endpoint after a successful authorization code flow.\u003c/li\u003e\n\u003cli\u003ePoweradmin queries its \u003ccode\u003eoidc_user_links\u003c/code\u003e database table to find an existing user linked to the received \u003ccode\u003eoidc_subject\u003c/code\u003e and \u003ccode\u003eprovider_id\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the \u003ccode\u003eutf8mb4_unicode_ci\u003c/code\u003e collation used for \u003ccode\u003eoidc_subject\u003c/code\u003e, the database query interprets the attacker's \u003ccode\u003esub\u003c/code\u003e (\u003ccode\u003evictím-login\u003c/code\u003e) as equal to the victim's \u003ccode\u003esub\u003c/code\u003e (\u003ccode\u003evictim-login\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe database returns the \u003ccode\u003euser_id\u003c/code\u003e associated with the victim's account, and Poweradmin establishes an authenticated session for the attacker under the victim's identity, leading to account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows an unauthenticated attacker, with control over an OIDC account that has a colliding subject identifier, to gain full access to a victim's Poweradmin account. This can result in unauthorized modification or deletion of DNS records, compromise of administrative settings, and complete control over the PowerDNS environment managed by Poweradmin. The attacker can achieve this without knowing or modifying the victim's password, leveraging only their own OIDC credentials and the database collation weakness. No specific victim counts or targeted sectors were provided, but any organization using affected Poweradmin versions with OIDC authentication is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Poweradmin installations to versions 4.2.5, 4.3.4, or 4.4.0 immediately to address the OIDC \u003ccode\u003esub\u003c/code\u003e collation bypass vulnerability.\u003c/li\u003e\n\u003cli\u003eAs part of the upgrade process, execute the provided SQL update script located in the \u003ccode\u003esql/\u003c/code\u003e directory for your specific database to migrate the \u003ccode\u003eoidc_user_links\u003c/code\u003e table columns (\u003ccode\u003eoidc_subject\u003c/code\u003e, \u003ccode\u003eprovider_id\u003c/code\u003e) to a binary or byte-preserving collation (e.g., \u003ccode\u003eutf8mb4_bin\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eReview other identity and authorization lookups within your Poweradmin environment, specifically \u003ccode\u003efindUserByEmail()\u003c/code\u003e, \u003ccode\u003efindPermissionTemplateByName()\u003c/code\u003e, and \u003ccode\u003efindGroupByName()\u003c/code\u003e, to ensure they enforce byte-exact matching where security boundaries are involved.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T22:02:03Z","date_published":"2026-07-24T22:02:03Z","id":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-oidc-collation-bypass/","summary":"A collation vulnerability in Poweradmin's OIDC integration allows an unauthenticated attacker to take over victim accounts by exploiting the case and accent-insensitive MySQL collation (`utf8mb4_unicode_ci`) used for OIDC subject (`sub`) identifiers, causing the attacker's colliding `sub` to resolve to the victim's `user_id` during authentication.","title":"Poweradmin OIDC `sub` Collation Bypass Leads to Account Takeover","url":"https://feed.craftedsignal.io/briefs/2026-07-poweradmin-oidc-collation-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Poweradmin","version":"https://jsonfeed.org/version/1.1"}