Read the docs
TI-2026-10386 Aliases CVE-2026-12049GHSA-7r93-vp6c-cw5m

pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter

Priority LOW 24CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mfa/validate?next=<external> -- a link typically delivered by phishing -- would be sent to an attacker-controlled host directly out of the trusted auth flow. The defect is a trusted-domain redirect, not a privilege bypass: the attacker gains no read/write access to pgAdmin or the victim's database, but the redirect launders the attacker's destination through pgAdmin's URL, which raises the success rate of credential-phishing follow-on against the victim. Fix introduces a same-origin _is_safe_redirect_url helper and gates every MFA redirect that consumes user-supplied 'next' values through it. The helper allows only relative paths and absolute URLs whose scheme is http(s) and whose host matches the current request host; it rejects external hosts in absolute and protocol-relative form, non-http schemes (javascript:, data:, mailto:), userinfo tricks (http://localhost@attacker/), and backslash variants that some browsers normalize to forward slashes. Unsafe targets fall back to the internal browser index. A dedicated regression test exercises each accept/reject category and the original reporter PoC. This issue affects pgAdmin 4: from 6.0 before 9.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed pgAdmin 4 (pgadmin.org): 9.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pgadmin.orgpgAdmin 46.0 to before 9.169.16Patch availableCNA
  • pgAdmin 4 Vendorpgadmin.org Affected 6.0 to before 9.16 Fixed in 9.16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*6.0 to before 9.16Vulnerablepgadmin.org
  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 6.0 to before 9.16 Vulnerable ·pgadmin.org

Remediation

  • Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    pgadmin.org pgAdmin 4 9.16

    7 records Highest priority Priority MEDIUM 4 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-10383 Missing authentication in pgadmin.org pgAdmin 4Priority MEDIUM 45
    • TI-2026-10382 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionPriority MEDIUM 43
    • TI-2026-10385 pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserPriority MEDIUM 42
    Show all 7 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12049
  2. 2026-10-03 Alias added: GHSA-7r93-vp6c-cw5m

References

Patch 2

  • TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
  • TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
  • TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
  • TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
  • TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
  • TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5
See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences