CVE-2026-54588: Account Takeover via Host Header Injection in Poweradmin Authentication

Vulnerability ID: CVE-2026-54588
CVSS Score: 9.6
Published: 2026-07-28

Poweradmin is affected by a critical Host Header Injection vulnerability within its Single Sign-On (SSO) and logout authentication mechanisms. The application dynamically constructs external redirection and callback URLs using the client-controlled HTTP Host header. An unauthenticated attacker can exploit this behavior to poison OAuth and SAML callback parameters, redirecting authentication credentials directly to a malicious external server. This allows full administrative account takeover without credentials when a victim accesses a manipulated authentication link.

TL;DR

Unauthenticated remote attackers can capture OAuth authorization codes or SAML assertions by poisoning the client-controlled HTTP Host header during authentication initialization, leading to complete account takeover of Poweradmin administrators.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-54588
• CWE ID: CWE-20
• Attack Vector: Network
• CVSS v3.1 Score: 9.6
• Exploit Maturity: PoC / Manual
• Impact: Administrative Account Takeover

Affected Systems

• Poweradmin authentication flow components
• Poweradmin: < 4.2.4 (Fixed in: 4.2.4)
• Poweradmin: >= 4.3.0, < 4.3.3 (Fixed in: 4.3.3)

Mitigation Strategies

• Enforce strict base URL validation using a static configuration value rather than HTTP request headers
• Deploy a catch-all server block at the reverse proxy layer to drop unvalidated host requests
• Configure strict redirect URI whitelist match patterns inside the Identity Provider configuration

Remediation Steps:

1. Locate the Poweradmin deployment directory and identify the running version
2. Download and deploy Poweradmin v4.2.4 (if using the 4.2 branch) or v4.3.3 (if using the 4.3 branch)
3. Configure the absolute base URL parameter inside the settings configuration file
4. Verify that the reverse proxy is configured to discard requests containing invalid Host headers
5. Confirm that the SSO Identity Provider does not allow wildcard matches in the Redirect URI whitelist

References

• Poweradmin Release v4.2.4
• Poweradmin Release v4.3.3
• GitHub Security Advisory GHSA-3735-5339-xfwx
• NVD CVE-2026-54588
• CVE.org CVE-2026-54588
• OSV Advisory Record

Read the full report for CVE-2026-54588 on our website for more details including interactive diagrams and full exploit analysis.