pgAdmin 4 CVE-2026-7820

The vulnerability requires the following specific conditions: (1) pgAdmin 4 instance must be accessible over the network (AV:N confirmed by CVSS); (2) the target account must use INTERNAL authentication source (accounts with LDAP, OAuth2, Kerberos, or Webserver authentication are protected); (3) the attacker must know or guess a valid username for an INTERNAL account; (4) the Flask-Security /login endpoint must be reachable from the attacker's network position (no authentication or special privileges required). No user interaction is required and the attack succeeds against default configurations. The vulnerability does NOT require: account pre-lockout (attackers can perform unbounded guessing without triggering lockout first), non-default MAX_LOGIN_ATTEMPTS settings (the bypass works regardless of the configured threshold), or authentication credentials for other accounts. Organizations using only centralized authentication (LDAP, OAuth2, Kerberos, Webserver) with no INTERNAL accounts have zero exploitable surface.

CVSS 6.5 with network vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation with low complexity and no user interaction required. The vulnerability provides two distinct attack paths: (1) credential enumeration via lockout bypass for accounts previously locked by brute-force attempts, and (2) unbounded password guessing against any INTERNAL account without rate-limiting or account lockout consequences. The impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact, as attackers can gain unauthorized session access but cannot directly cause service disruption. No EPSS score or KEV status is provided, so exploitation probability cannot be independently assessed; however, the straightforward attack vector (sending HTTP requests to an unauthenticated endpoint) and low technical complexity suggest practical exploitability. The limitation to INTERNAL authentication sources reduces the real-world risk surface in organizations using centralized identity systems (LDAP, OAuth2, Kerberos), but any pgAdmin instance with local user accounts faces direct risk. The fact that this bypasses a known security control (MAX_LOGIN_ATTEMPTS) elevates priority despite the moderate CVSS score.

An attacker discovers a pgAdmin 4 instance and identifies a valid username through information disclosure or enumeration. The attacker submits invalid credentials multiple times to /authenticate/login, triggering the account lockout by exceeding MAX_LOGIN_ATTEMPTS. However, instead of giving up, the attacker then bypasses the lockout by submitting the same valid credentials directly to Flask-Security's /login endpoint, obtaining a valid session without triggering the lockout mechanism. Alternatively, an attacker can skip the lockout trigger entirely and perform continuous password-guessing against /login with no rate-limiting or lockout consequences, eventually recovering credentials through brute force.