Skip to main content

pgAdmin 4 CVE-2026-12049

| EUVDEUVD-2026-37969 MEDIUM
URL Redirection to Untrusted Site (Open Redirect) (CWE-601)
2026-06-18 PostgreSQL GHSA-7r93-vp6c-cw5m
Open Redirect Pgadmin 4
5.3
CVSS 4.0 · Vendor: PostgreSQL
Share

Severity by source

Vendor (PostgreSQL) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Attacker needs no privileges (PR:N); victim must click crafted link (UI:R); impact is limited to unauthorized redirect integrity violation with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Red Hat
3.5 LOW
qualitative

Primary rating from Vendor (PostgreSQL).

CVSS VectorVendor: PostgreSQL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jun 19, 2026 - 00:35 vuln.today
Analysis Generated
Jun 19, 2026 - 00:35 vuln.today
CVSS changed
Jun 19, 2026 - 00:22 NVD
4.3 (MEDIUM) 5.3 (MEDIUM)

DescriptionCVE.org

Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mfa/validate?next=<external> -- a link typically delivered by phishing -- would be sent to an attacker-controlled host directly out of the trusted auth flow.

The defect is a trusted-domain redirect, not a privilege bypass: the attacker gains no read/write access to pgAdmin or the victim's database, but the redirect launders the attacker's destination through pgAdmin's URL, which raises the success rate of credential-phishing follow-on against the victim.

Fix introduces a same-origin _is_safe_redirect_url helper and gates every MFA redirect that consumes user-supplied 'next' values through it. The helper allows only relative paths and absolute URLs whose scheme is http(s) and whose host matches the current request host; it rejects external hosts in absolute and protocol-relative form, non-http schemes (javascript:, data:, mailto:), userinfo tricks (http://localhost@attacker/), and backslash variants that some browsers normalize to forward slashes. Unsafe targets fall back to the internal browser index. A dedicated regression test exercises each accept/reject category and the original reporter PoC.

This issue affects pgAdmin 4: from 6.0 before 9.16.

AnalysisAI

Open redirect in pgAdmin 4's MFA validate and register endpoints allows network-accessible attackers to abuse the authentication flow as a phishing launchpad. Affected versions 6.0 through 9.15 pass the user-supplied 'next' query and form parameter directly to Flask's redirect response without verifying the target is same-origin, meaning a crafted URL such as /mfa/validate?next=https://attacker.example/fake-login silently forwards the victim from a trusted pgAdmin URL to an attacker-controlled site. No public exploit is identified at time of analysis and this CVE is not listed in CISA KEV; however, a reporter-supplied PoC was confirmed by the vendor and is documented in the upstream regression test suite.

Technical ContextAI

pgAdmin 4 (CPE: cpe:2.3:a:pgadmin.org:pgadmin_4:*:*:*:*:*:*:*:*) is a Python/Flask web application for administering PostgreSQL databases. Its multi-factor authentication flow is implemented in web/pgadmin/authenticate/mfa/views.py, where two endpoints - mfa.validate and the MFA registration handler - previously consumed the 'next' parameter from request.args or form data without origin checking. The root cause is CWE-601 (URL Redirection to Untrusted Site): the application trusted user-controlled input to define redirect destinations. The fix introduces a _is_safe_redirect_url() helper built on Python's urllib.parse.urlparse and urljoin, which enforces that redirect targets must either be relative paths or absolute URLs whose scheme is http/https and whose netloc matches the current request host. Backslash variants (e.g., /\attacker.example) are also explicitly rejected to prevent browser normalization bypasses. The same-origin gate is now applied at every point in the validate and registration views where 'next' is consumed, with fallback to the internal browser index on failure.

RemediationAI

Upgrade pgAdmin 4 to version 9.16 or later, which introduces the _is_safe_redirect_url same-origin validation helper gating all 'next' parameter consumption in the MFA flow. The fix commit is available at https://github.com/pgadmin-org/pgadmin4/commit/fff6a481854b07822c2b54e8181e6a9076d204cd. If immediate upgrade is not possible, a targeted workaround is to deploy a reverse-proxy or WAF rule that strips or rejects any 'next' query parameter on requests to the /mfa/validate and /mfa/register endpoints; this eliminates the attack surface entirely but may break legitimate post-MFA redirects within the application if your deployment relies on that parameter. Disabling MFA enrollment entirely (if operationally feasible) would also eliminate the vulnerable endpoints, though this trades one risk for another. There is no indication that restricting network access to pgAdmin mitigates this issue beyond reducing phishing-link delivery opportunity, since the attacker requires no server-side access.

More in Open Redirect

View all
CVE-2017-1000117 HIGH POC
8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
CVE-2024-52875 HIGH POC
8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
CVE-2016-5385 HIGH POC
8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
CVE-2013-2248 MEDIUM POC
5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
CVE-2012-6499 MEDIUM POC
5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM POC
4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
CVE-2017-3528 MEDIUM POC
5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
CVE-2012-0518 MEDIUM
4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
CVE-2024-21641 MEDIUM POC
6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
CVE-2015-5354 MEDIUM POC
5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM POC
6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL POC
9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all
CVE-2017-1000117 HIGH POC
8.8
CVE-2016-5385 HIGH POC
8.1
CVE-2017-3528 MEDIUM POC
5.4
CVE-2012-0518 MEDIUM
4.7
CVE-2024-21641 MEDIUM POC
6.5
CVE-2015-5354 MEDIUM POC
5.8
CVE-2024-22891 CRITICAL POC
9.8
CVE-2022-40083 CRITICAL POC
9.6

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Not-Affected

Share

CVE-2026-12049 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy