Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security flaw in its multi-factor authentication (MFA) process. An attacker can create a malicious link that, once a user finishes logging in, automatically redirects them to a fraudulent website. This can be used in phishing campaigns to trick users into providing their credentials to a site that looks like a legitimate login page, potentially leading to account takeover.
Technical details
An open redirect vulnerability (CWE-601) exists in pgAdmin 4's MFA validation and registration endpoints. The application fails to validate the 'next' query or form parameter, allowing it to redirect users to arbitrary external domains after successful MFA completion. An attacker can exploit this by sending a crafted URL to an authenticated user; the redirect 'launders' the malicious destination through the trusted pgAdmin domain, increasing the effectiveness of phishing attacks. The fix introduces a same-origin validation helper that restricts redirects to relative paths or absolute URLs matching the current request host. This affects versions 6.0 through 9.15 and is patched in version 9.16.
Affected products
- pgadmin.org pgAdmin 4 6.0 to 9.15
Timeline
- 2026-06-08: disclosed: Issue opened in pgAdmin 4 repository
- 2026-06-18: patched: Fixed in version 9.16 via commit fff6a4818
- 2026-06-19: advisory: CVE-2026-12049 published