A host header injection flaw in Poweradmin allows an attacker to control the HTTP_HOST request header. The application uses this header without validation to build redirect URIs in its OIDC, SAML, and logout authentication flows. By injecting a malicious value, an unauthenticated attacker can poison the redirect_uri sent to the identity provider, causing the victim’s authorization code to be sent to an attacker‑controlled endpoint. This results in full account takeover with no credentials required and is categorized as CWE‑20 and CWE‑601.

The affected product is Poweradmin, a web‑based DNS administration tool for PowerDNS. Versions older than 4.2.4 and older than 4.3.3 contain the vulnerability; the releases 4.2.4 and 4.3.3 contain the fix.

The CVSS score of 9.6 places this vulnerability in the high‑severity range. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out by sending a crafted HTTP request to the application over HTTP or HTTPS, altering the Host header, and the attacker requires no prior authentication. Given the high complexity of the vulnerability and the importance of the affected application, the risk is considered very high.