Vulnerability · Published Sep 23, 2024 · Assigned by PostgreSQL
CVE-2024-9014OAuth2 client id and secret exposed through the web browser in pgAdmin 4
Critical 9.9
In plain English
A critical-severity security flaw in pgAdmin 4 from pgadmin.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.7% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)9.7%top 4.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pgadmin4 | 8.12 | GHSA-jm9x-rx9x-wpqj |
| PyPI | pgadmin4 | 8.12 | PYSEC-2026-1775 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pgadmin.org | pgAdmin 4 | 0 – before 8.12 |
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/pgadmin-org/pgadmin4/issues/7945 issue-tracking