Poweradmin maps OIDC identities to local users using the oidc_user_links table, which stores the OIDC subject identifier (sub) with a utf8mb4_unicode_ci collation in MySQL. This collation is accent- and case-insensitive, causing different subjects such as 'victim-login' and 'victím-login' to be treated as equal. During authentication, Poweradmin performs a SQL equality lookup on the OIDC subject, which returns the victim's user ID when the attacker authenticates with the accent-variant subject. Consequently, the attacker obtains a session authenticated as the victim without needing the victim's password. The vulnerability affects Poweradmin versions >=4.1.0 <4.2.5 and >=4.3.0 <4.3.4. No official patch or remediation is indicated in the provided data.

An attacker who can create or control an OIDC account with a subject identifier that collides under the utf8mb4_unicode_ci collation with a victim's subject can authenticate to Poweradmin as the victim. This results in account takeover without requiring the victim's credentials. The attacker gains full access to the victim's Poweradmin session, potentially compromising sensitive data and administrative capabilities. The vulnerability does not affect availability but has high confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider mitigating the risk by configuring the database to use a binary or accent-sensitive collation for the oidc_subject column or implementing application-level checks to enforce exact byte-for-byte matching of OIDC subjects. Additionally, restricting or monitoring OIDC provider registrations to prevent creation of colliding subjects may reduce risk.