CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Synopsis

Host header injection in Poweradmin (a web-based DNS administration tool for PowerDNS) allows an unauthenticated remote attacker to poison the redirect_uri used in OIDC, SAML, and logout authentication flows. By manipulating the HTTP_HOST header, the attacker causes the identity provider to redirect a victim's authorization code to an attacker-controlled server, requiring only that the victim clicks through a crafted authentication link. Successful exploitation results in full account takeover with no credentials required. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment fix versions are confirmed upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Poweradmin web interface over the network to inject a malicious HTTP_HOST header into authentication flow requests.

• AuthenticationNot required

  No account or credentials are needed; the attack is carried out entirely by an unauthenticated party who crafts a poisoned authentication link.

• Victim interactionRequired

  A legitimate user must follow the attacker-crafted authentication link, triggering the identity provider redirect that delivers the authorization code to the attacker.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: no race conditions or special environment state are required beyond delivering the poisoned link to a victim.

Blast Radius

• Reads the victim's authorization code redirected from the identity provider, enabling the attacker to complete authentication as that user and access any resource the account can reach.
• Modifies DNS zone data and records managed through Poweradmin, because the attacker holds a fully authenticated session after takeover.
• Gains the ability to alter or delete PowerDNS server configuration through the compromised account, depending on the account's privilege level.
• Causes partial service disruption to availability if the attacker uses the takeover to make destructive changes to DNS records or zone data.