Attack Chain

1. A legitimate victim links their OIDC account with Poweradmin; Poweradmin stores the victim's OIDC sub (e.g., victim-login) in the oidc_user_links table with a utf8mb4_unicode_ci collation.
2. An attacker creates an OIDC account at the same OIDC provider with a sub identifier that is a collation variant of the victim's sub (e.g., victím-login), exploiting the accent-insensitive nature of the collation.
3. The attacker initiates an OIDC login to Poweradmin by accessing /oidc/login?provider=generic and authenticates with their attacker OIDC credentials (victím-login).
4. Poweradmin receives the attacker's OIDC sub (victím-login) from the OIDC provider's userinfo endpoint after a successful authorization code flow.
5. Poweradmin queries its oidc_user_links database table to find an existing user linked to the received oidc_subject and provider_id.
6. Due to the utf8mb4_unicode_ci collation used for oidc_subject, the database query interprets the attacker's sub (victím-login) as equal to the victim's sub (victim-login).
7. The database returns the user_id associated with the victim's account, and Poweradmin establishes an authenticated session for the attacker under the victim's identity, leading to account takeover.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker, with control over an OIDC account that has a colliding subject identifier, to gain full access to a victim's Poweradmin account. This can result in unauthorized modification or deletion of DNS records, compromise of administrative settings, and complete control over the PowerDNS environment managed by Poweradmin. The attacker can achieve this without knowing or modifying the victim's password, leveraging only their own OIDC credentials and the database collation weakness. No specific victim counts or targeted sectors were provided, but any organization using affected Poweradmin versions with OIDC authentication is at risk.

Recommendation

• Patch Poweradmin installations to versions 4.2.5, 4.3.4, or 4.4.0 immediately to address the OIDC sub collation bypass vulnerability.
• As part of the upgrade process, execute the provided SQL update script located in the sql/ directory for your specific database to migrate the oidc_user_links table columns (oidc_subject, provider_id) to a binary or byte-preserving collation (e.g., utf8mb4_bin).
• Review other identity and authorization lookups within your Poweradmin environment, specifically findUserByEmail(), findPermissionTemplateByName(), and findGroupByName(), to ensure they enforce byte-exact matching where security boundaries are involved.