# CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

Source: https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13  
License: CC BY 4.0 with a link back

CVE-2025-12765 · Severity: high · CVSS 7.5 · Published 2025-11-13

pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4), [pgadmin4 (PyPI)](https://junglewise.ai/threats/technologies/pgadmin4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-12765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12765 being exploited in the wild.

**How severe is CVE-2025-12765?** High severity, with a CVSS score of 7.5, published 13 November 2025.

**Which products and versions are affected?** pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.10.

**Is there a fix for CVE-2025-12765?** Yes. pgadmin4 (PyPI): upgrade to 9.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-12765?** Check whether you run Pgadmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pgadmin4 (PyPI): upgrade to 9.10 or later

  ```sh
  pip install "pgadmin4>=9.10"
  ```


## Affected products

- Pgadmin 4
- pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.10

## Identifiers

- CVE-2025-12765
- GHSA-g4r8-3qmh-pmch
- PYSEC-2026-1773

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)