GHSA-3735-5339-xfwx: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Summary Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Three independent code paths are affected: - Primary (Critical): OidcService::getCallbackUrl() - redirect_uri poisoning - Secondary (High): SamlConfigurationService::getBaseUrl() - SAML ACS/SLO URL poisoning - Tertiary (Medium): LogoutController::getBaseUrl() - post-logout redirect poisoning Details *Root Cause* The application constructs absolute URLs dynamically from HTTP_HOST rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow. Poweradmin's own codebase contains the correct pattern - DocsController::getValidatedHost() (line 244) calls isValidHostname() before using the value - but this was never applied to authentication flows. Primary: lib/Application/Service/OidcService.php (~line 460) private function getCallbackUrl(): string { $scheme = $this->detectScheme(); // HTTP_HOST taken directly with zero validation $host = $this->request->getServerParam('HTTP_HOST', 'localhost'); $basePrefix = $this->configManager->get('interface', 'base_url_prefix', ''); return $scheme . '://' . $host . $basePrefix . '/oidc/callback'; } HTTP_HOST is embedded verbatim as redirect_uri in the OAuth 2.0 authorization request sent to the IdP. HTTP_X_FORWARDED_PROTO is similarly used unvalidated for scheme detection. Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134) private function getBaseUrl(): string { $configuredBaseUrl = $this->configManager->get('interface', 'base_url', ''); if (!empty($configuredBaseUr