GHSA-6859-2qxq-ffv2 CVE-2025-9636 PYSEC-2026-1769
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
- Severity
- 7.9 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.23%
- Chance of exploitation in the next 30 days. Higher than 13.43% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
9.8- Upgrade pgadmin4 to this version or later
Description
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| pgadmin4 | < 9.8 |
9.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
pgadmin4 PyPI → 9.8
- pip
pip install --upgrade "pgadmin4>=9.8"- poetry
poetry add "pgadmin4>=9.8"- uv
uv add "pgadmin4>=9.8"
Severity breakdown
CVSS 3.1 7.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hv9p-2pqf-r5w3 pgAdmin 4: Improper restriction of excessive authentication attempts | Medium | Also affects pgadmin4 |
| GHSA-hr4r-fwpv-c95j pgAdmin 4 File Manager has symbolic-link path traversal | High | Also affects pgadmin4 |
| GHSA-4rhg-h8f2-v4jm pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager | High | Also affects pgadmin4 |
| GHSA-p58c-q354-6c4f pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities | Medium | Also affects pgadmin4 |
| GHSA-j74f-g7vx-fh4x pgAdmin 4: OS command injection vulnerability in Import/Export query export | High | Also affects pgadmin4 |
| GHSA-hp84-p2gq-6fvr SQL injection vulnerability in pgAdmin 4 Maintenance Tool | High | Also affects pgadmin4 |
| GHSA-6p2c-69cv-3fxq pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules | Medium | Also affects pgadmin4 |
| GHSA-h2x2-q2mc-24gw pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules | Critical | Also affects pgadmin4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor