CVE-2026-54588
1 advisory.
Packagist/poweradmin/poweradmin CVE-2026-54588: critical 9.6
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.
Action: Upgrade poweradmin/poweradmin to 4.2.4 or later.
composer require poweradmin/poweradmin:4.2.4composer require poweradmin/poweradmin:4.3.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.2.4 | - |
| 4.3.0 | 4.3.3 | - |
Fixed versions
| 4.2.4 | 4.3.3 |
Sources
- osv: GHSA-3735-5339-xfwx
- https://github.com/poweradmin/poweradmin/security/advisories/GHSA-3735-5339-xfwx
- https://nvd.nist.gov/vuln/detail/CVE-2026-54588
- https://github.com/poweradmin/poweradmin
- https://github.com/poweradmin/poweradmin/releases/tag/v4.2.4
- https://github.com/poweradmin/poweradmin/releases/tag/v4.3.3
CVE-2026-54588 · published · modified · JSON