CVE-2026-54588: Account Takeover via Host Header Injection in Poweradmin Authentication
Vulnerability ID: CVE-2026-54588
CVSS Score: 9.6
Published: 2026-07-28
Poweradmin is affected by a critical Host Header Injection vulnerability within its Single Sign-On (SSO) and logout authentication mechanisms. The application dynamically constructs external redirection and callback URLs using the client-controlled HTTP Host header. An unauthenticated attacker can exploit this behavior to poison OAuth and SAML callback parameters, redirecting authentication credentials directly to a malicious external server. This allows full administrative account takeover without credentials when a victim accesses a manipulated authentication link.
TL;DR
Unauthenticated remote attackers can capture OAuth authorization codes or SAML assertions by poisoning the client-controlled HTTP Host header during authentication initialization, leading to complete account takeover of Poweradmin administrators.
⚠️ Exploit Status: POC
Technical Details
- Vulnerability ID: CVE-2026-54588
- CWE ID: CWE-20
- Attack Vector: Network
- CVSS v3.1 Score: 9.6
- Exploit Maturity: PoC / Manual
- Impact: Administrative Account Takeover
Affected Systems
- Poweradmin authentication flow components
-
Poweradmin: < 4.2.4 (Fixed in:
4.2.4) -
Poweradmin: >= 4.3.0, < 4.3.3 (Fixed in:
4.3.3)
Mitigation Strategies
- Enforce strict base URL validation using a static configuration value rather than HTTP request headers
- Deploy a catch-all server block at the reverse proxy layer to drop unvalidated host requests
- Configure strict redirect URI whitelist match patterns inside the Identity Provider configuration
Remediation Steps:
- Locate the Poweradmin deployment directory and identify the running version
- Download and deploy Poweradmin v4.2.4 (if using the 4.2 branch) or v4.3.3 (if using the 4.3 branch)
- Configure the absolute base URL parameter inside the settings configuration file
- Verify that the reverse proxy is configured to discard requests containing invalid Host headers
- Confirm that the SSO Identity Provider does not allow wildcard matches in the Redirect URI whitelist
References
- Poweradmin Release v4.2.4
- Poweradmin Release v4.3.3
- GitHub Security Advisory GHSA-3735-5339-xfwx
- NVD CVE-2026-54588
- CVE.org CVE-2026-54588
- OSV Advisory Record
Read the full report for CVE-2026-54588 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (1)
The Host Header Injection vulnerability in Poweradmin's authentication mechanism is a critical issue, with a CVSS score of 9.6, and it's concerning to see how an unauthenticated attacker can exploit this to capture OAuth authorization codes or SAML assertions. I've worked on similar SSO implementations and can attest to the importance of validating the Host header, as you've suggested in the mitigation strategies, using a static configuration value instead of relying on HTTP request headers. One potential improvement to the remediation steps could be to also consider implementing additional security measures, such as monitoring for suspicious login attempts or using a Web Application Firewall (WAF) to detect and prevent potential attacks. What are your thoughts on using a WAF as an additional layer of protection against similar vulnerabilities?