CVE-2026-54588

CVE

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

June 24, 2026

Last Seen

June 25, 2026

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical Host Header Injection Vulnerability in Poweradmin (CVE-2026-54588)78.0

A critical vulnerability identified as CVE-2026-54588 affects Poweradmin, a web-based DNS administration tool for PowerDNS server. The flaw allows unauthenticated attackers to exploit the HTTP_HOST request header to manipulate callback URLs in OIDC, SAML, and logout flows. This can lead to account t...

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (1)

Critical Host Header Injection Vulnerability in Poweradmin (CVE-2026-54588)

Jun 25·1 sources

Related Articles (2)

CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. [CRITICAL] CVSS 9.6 Exploit Intelligence — Recent CVEs / 23h Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthe

exploit-intel.com·Jun 25

CVE-2026-54588 - Exploits & Severity

Related Entities

Data Breach CWE-601 - Open Redirect CWE-287 - Improper Authentication Poweradmin PowerDNS