Poweradmin OIDC/SAML Host Header Injection Enables Full Account Takeover and DNS Zone Compromise (CVE-2026-54588)

What Happened

A GitHub Security Advisory (GHSA-3735-5339-xfwx, CVE-2026-54588) discloses a Host header injection vulnerability in Poweradmin v4.3.2, a web-based DNS administration front-end for PowerDNS. According to the advisory, three separate code paths — the OIDC callback URL builder (OidcService::getCallbackUrl()), the SAML base URL builder (SamlConfigurationService::getBaseUrl()), and the logout redirect builder (LogoutController::getBaseUrl()) — construct absolute URLs directly from the attacker-controlled HTTP_HOST (and, for scheme detection, HTTP_X_FORWARDED_PROTO) request header, with no hostname validation. A publicly available proof of concept demonstrates that setting HTTP_HOST to attacker.com causes the OIDC redirect_uri sent to the Identity Provider to be poisoned to http://attacker.com/oidc/callback. The advisory notes PKCE does not mitigate this, since the attacker initiates the authorization flow and controls both the challenge and verifier. CVSS is reported at 8.2 (standard deployment) to 9.3 (when a reverse proxy forwards the raw Host header, e.g. nginx's default proxy_set_header Host $http_host).

Why It Matters

Per the advisory, successful exploitation lets an unauthenticated attacker redirect a victim's OIDC authorization code (or poison SAML ACS/SLO/entity ID values) to an attacker-controlled endpoint, resulting in full authenticated access to Poweradmin — no credentials or prior access required. Because Poweradmin manages PowerDNS, the advisory states that a compromised admin account grants full DNS zone control, which it describes as enabling MX record hijacking (email/2FA interception), SPF/DKIM manipulation to send DMARC-passing spoofed mail, subdomain takeover, and abuse of ACME DNS-01 validation to obtain wildcard TLS certificates. This makes the blast radius extend well beyond the Poweradmin application itself to the organization's entire DNS-dependent trust chain.

What Defenders Should Do Now

• Identify any Poweradmin instances (especially v4.3.2 or earlier) with OIDC or SAML authentication enabled.
• As an immediate mitigation, set interface.base_url in config/settings.php — the advisory confirms this activates the safe, non-Host-header code path for SAML; validate whether an equivalent fix is available/applied for the OIDC and logout flows once a patched release is out.
• Review reverse proxy configuration in front of Poweradmin for blind Host-header forwarding (e.g. nginx proxy_set_header Host $http_host) and pin the Host header to the expected value instead.
• Hunt for anomalous or unexpected Host header values in access logs to Poweradmin's /oidc/, SAML ACS/SLO, and logout endpoints, and for authorization requests/redirect_uri values referencing unexpected domains at the IdP side.
• Given the DNS blast radius described in the advisory, review PowerDNS zone change history for unexpected MX, SPF/DKIM, CAA, or delegation record changes as a compromise indicator.

Developing Intel

This is a same-day disclosure with a public proof of concept and no confirmed patched version referenced in the source material at time of writing; treat details as preliminary and monitor the advisory for an official fix. Full technical details: GHSA-3735-5339-xfwx.