# CVE-2026-12049: pgAdmin 4 open redirect in multi-factor authentication flow

Source: https://junglewise.ai/threats/cve-2026-12049-pgadmin-4-open-redirect-in-multi-factor-authentication-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-12049 · Severity: medium · CVSS 4.3 · Published 2026-06-19

pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security flaw in its multi-factor authentication (MFA) process. An attacker can create a malicious link that, once a user finishes logging in, automatically redirects them to a fraudulent website. This can be used in phishing campaigns to trick users into providing their credentials to a site that looks like a legitimate login page, potentially leading to account takeover.

## Quick answers

**Is CVE-2026-12049 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12049 being exploited in the wild.

**How severe is CVE-2026-12049?** Medium severity, with a CVSS score of 4.3, published 19 June 2026.

**Which products and versions are affected?** pgadmin.org pgAdmin 4 6.0 to 9.15.

**Is there a fix for CVE-2026-12049?** A patch was published on 2026-06-18: Fixed in version 9.16 via commit fff6a4818 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12049 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-12049?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in pgAdmin 4's MFA validation and registration endpoints. The application fails to validate the 'next' query or form parameter, allowing it to redirect users to arbitrary external domains after successful MFA completion. An attacker can exploit this by sending a crafted URL to an authenticated user; the redirect 'launders' the malicious destination through the trusted pgAdmin domain, increasing the effectiveness of phishing attacks. The fix introduces a same-origin validation helper that restricts redirects to relative paths or absolute URLs matching the current request host. This affects versions 6.0 through 9.15 and is patched in version 9.16.

## Affected products

- pgadmin.org pgAdmin 4 6.0 to 9.15

## Timeline

- 2026-06-08: disclosed: Issue opened in pgAdmin 4 repository
- 2026-06-18: patched: Fixed in version 9.16 via commit fff6a4818
- 2026-06-19: advisory: CVE-2026-12049 published

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/mfa/views.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/authenticate/mfa/views.py)
- [https://github.com/pgadmin-org/pgadmin4/commit/fff6a481854b07822c2b54e8181e6a9076d204cd](https://github.com/pgadmin-org/pgadmin4/commit/fff6a481854b07822c2b54e8181e6a9076d204cd)
- [https://github.com/pgadmin-org/pgadmin4/issues/10028](https://github.com/pgadmin-org/pgadmin4/issues/10028)