CVE-2026-54588
Summary
Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the
authoritative source for building callback URLs in its OIDC, SAML, and logout
authentication flows without any validation. An unauthenticated attacker can poison
the redirect_uri sent to the Identity Provider, causing the IdP to redirect the
victim's authorization code to an attacker-controlled server - resulting in full
account takeover with no credentials required.
Three independent code paths are affected:
- Primary (Critical): OidcService::getCallbackUrl() - redirect_uri poisoning
- Secondary (High): SamlConfigurationService::getBaseUrl() - SAML ACS/SLO URL poisoning
- Tertiary (Medium): LogoutController::getBaseUrl() - post-logout redirect poisoning
Details
*Root Cause*
The application constructs absolute URLs dynamically from HTTP_HOST rather than
from a trusted configured base URL. The header is fully client-controlled and is not
validated before use in any authentication flow.
Poweradmin's own codebase contains the correct pattern -
DocsController::getValidatedHost() (line 244) calls isValidHostname() before
using the value - but this was never applied to authentication flows.
Primary: lib/Application/Service/OidcService.php (~line 460)
private function getCallbackUrl(): string
{
$scheme = $this->detectScheme();
// HTTP_HOST taken directly with zero validation
$host = $this->request->getServerParam('HTTP_HOST', 'localhost');
$basePrefix = $this->configManager->get('interface', 'base_url_prefix', '');
return $scheme . '://' . $host . $basePrefix . '/oidc/callback';
}
HTTP_HOST is embedded verbatim as redirect_uri in the OAuth 2.0 authorization
request sent to the IdP. HTTP_X_FORWARDED_PROTO is similarly used unvalidated
for scheme detection.
Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134)
private function getBaseUrl(): string
{
$configuredBaseUrl = $this->configManager->get('interface', 'base_url', '');
if (!empty($configuredBaseUr
⚡ Watch CVE-2026-54588
Get an email if CVE-2026-54588 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
Advisory coverage (1)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-54588)