Skip to main content
VulnerabilityPublished 07/24/2026

Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeover

Affects poweradmin/poweradminSource GCVE Database

0
CVSS 3.1 base score
8.1High
How severe the flaw is on the 0–10 CVSS scale.
Patch
Available – fixed in 4.2.5, 4.3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

What to do

Affected software

ProductAffectedFixed in
Packagistpoweradmin/poweradminAffected
  • >=4.1.0 <4.2.5
Fixed in
  • 4.2.5
Packagistpoweradmin/poweradminAffected
  • >=4.3.0 <4.3.4
Fixed in
  • 4.3.4

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Administrators should consider mitigating the risk by configuring the database to use a binary or accent-sensitive collation for the oidc_subject column or implementing application-level checks to enforce exact byte-for-byte matching of OIDC subjects. Additionally, restricting or monitoring OIDC provider registrations to prevent creation of colliding subjects may reduce risk.

Description

Poweradmin contains a vulnerability in its handling of OpenID Connect (OIDC) subject identifiers due to the use of a case- and accent-insensitive collation (utf8mb4_unicode_ci) in the MySQL database schema. This causes distinct OIDC subjects that differ only by accents to be treated as identical, allowing an attacker controlling an OIDC account with an accent-variant subject to impersonate a victim's local account. The attacker authenticates with their own OIDC credentials but gains access to the victim's Poweradmin session without knowing the victim's password.

Impact

An attacker who can create or control an OIDC account with a subject identifier that collides under the utf8mb4_unicode_ci collation with a victim's subject can authenticate to Poweradmin as the victim. This results in account takeover without requiring the victim's credentials. The attacker gains full access to the victim's Poweradmin session, potentially compromising sensitive data and administrative capabilities. The vulnerability does not affect availability but has high confidentiality and integrity impact.

Summary

Poweradmin maps OIDC identities to local users using the oidc_user_links table, which stores the OIDC subject identifier (sub) with a utf8mb4_unicode_ci collation in MySQL. This collation is accent- and case-insensitive, causing different subjects such as 'victim-login' and 'victím-login' to be treated as equal. During authentication, Poweradmin performs a SQL equality lookup on the OIDC subject, which returns the victim's user ID when the attacker authenticates with the accent-variant subject. Consequently, the attacker obtains a session authenticated as the victim without needing the victim's password. The vulnerability affects Poweradmin versions >=4.1.0 <4.2.5 and >=4.3.0 <4.3.4. No official patch or remediation is indicated in the provided data.

Weaknesses

References

Community reviews

Loading reviews…