Executive brief
pgAdmin is a web-based administration tool for PostgreSQL databases used by database teams to manage databases, execute queries, and maintain database infrastructure. An attacker with a legitimate user's username and password can bypass the account's multi-factor authentication (MFA) protection to log in and perform sensitive actions such as managing files and executing SQL queries, undermining a key security control designed to protect database environments.
Technical details
pgAdmin versions 8.5 and earlier contain an authentication bypass vulnerability in the MFA implementation (CWE-89 related to improper input validation in authentication logic). An attacker with valid credentials can authenticate to the application without satisfying MFA requirements, allowing full access to protected database operations. The vulnerability requires knowledge of a legitimate account's username and password (valid credentials are a precondition); network access to pgAdmin is required. The fix was released in version 8.6, and patch commits are available in the project repository.
Affected products
- pgAdmin pgAdmin 4.0 through 8.5
Timeline
- 2024-05-02: disclosed: Vulnerability published to OSV
- 2024: patched: Fix released in pgAdmin 8.6