{"uuid": "15f10ecb-d003-4bfb-8d03-f13a8d28b9c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3735-5339-xfwx", "type": "seen", "source": "https://gist.github.com/alon710/10debd6350fb30cffecd8ed90a44aae9", "content": "# CVE-2026-54588: CVE-2026-54588: Account Takeover via Host Header Injection in Poweradmin Authentication\n\n> **CVSS Score:** 9.6\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54588\n\n## Summary\nPoweradmin is affected by a critical Host Header Injection vulnerability within its Single Sign-On (SSO) and logout authentication mechanisms. The application dynamically constructs external redirection and callback URLs using the client-controlled HTTP Host header. An unauthenticated attacker can exploit this behavior to poison OAuth and SAML callback parameters, redirecting authentication credentials directly to a malicious external server. This allows full administrative account takeover without credentials when a victim accesses a manipulated authentication link.\n\n## TL;DR\nUnauthenticated remote attackers can capture OAuth authorization codes or SAML assertions by poisoning the client-controlled HTTP Host header during authentication initialization, leading to complete account takeover of Poweradmin administrators.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-54588\n- **CWE ID**: CWE-20\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.6\n- **Exploit Maturity**: PoC / Manual\n- **Impact**: Administrative Account Takeover\n\n## Affected Systems\n\n- Poweradmin authentication flow components\n- **Poweradmin**: < 4.2.4 (Fixed in: `4.2.4`)\n- **Poweradmin**: >= 4.3.0, < 4.3.3 (Fixed in: `4.3.3`)\n\n## Mitigation\n\n- Enforce strict base URL validation using a static configuration value rather than HTTP request headers\n- Deploy a catch-all server block at the reverse proxy layer to drop unvalidated host requests\n- Configure strict redirect URI whitelist match patterns inside the Identity Provider configuration\n\n**Remediation Steps:**\n1. Locate the Poweradmin deployment directory and identify the running version\n2. Download and deploy Poweradmin v4.2.4 (if using the 4.2 branch) or v4.3.3 (if using the 4.3 branch)\n3. Configure the absolute base URL parameter inside the settings configuration file\n4. Verify that the reverse proxy is configured to discard requests containing invalid Host headers\n5. Confirm that the SSO Identity Provider does not allow wildcard matches in the Redirect URI whitelist\n\n## References\n\n- [Poweradmin Release v4.2.4](https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4)\n- [Poweradmin Release v4.3.3](https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3)\n- [GitHub Security Advisory GHSA-3735-5339-xfwx](https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx)\n- [NVD CVE-2026-54588](https://nvd.nist.gov/vuln/detail/CVE-2026-54588)\n- [CVE.org CVE-2026-54588](https://www.cve.org/CVERecord?id=CVE-2026-54588)\n- [OSV Advisory Record](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54588.json)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54588) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T17:31:58.866287Z"}