Threats Tagged 'ghsa-cmwh-g2h8-c222'

Poweradmin contains a vulnerability in its handling of OpenID Connect (OIDC) subject identifiers due to the use of a case- and accent-insensitive collation (utf8mb4_unicode_ci) in the MySQL database schema. This causes distinct OIDC subjects that differ only by accents to be treated as identical, allowing an attacker controlling an OIDC account with an accent-variant subject to impersonate a victim's local account. The attacker authenticates with their own OIDC credentials but gains access to the victim's Poweradmin session without knowing the victim's password.