pgAdmin 4 EUVD-2026-37969

Exploitation requires the victim to be a pgAdmin 4 user who is either mid-MFA-flow (between password submission and MFA completion) or otherwise directed to access the /mfa/validate or MFA registration endpoint with a crafted 'next' parameter. pgAdmin must be deployed in SERVER_MODE (multi-user web deployment) for the MFA routes to be registered - the test harness explicitly sets SERVER_MODE=True to exercise the vulnerable endpoints, confirming this is a server-mode-only condition. The attacker requires no pgAdmin credentials or session (CVSS PR:N). Exploitation is limited by the requirement for passive user interaction: the victim must follow the attacker-crafted pgAdmin URL (CVSS UI:P). Non-default MFA enablement is implicitly required, since the vulnerable endpoints only exist when MFA is configured. The attack yields no direct access to pgAdmin or the database - impact is limited to off-site phishing facilitation.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) correctly reflects a medium-severity, phishing-facilitation flaw with no direct data exfiltration or system compromise. The attack vector is network (AV:N) with low complexity (AC:L), but passive user interaction (UI:P) is required, meaning the victim must click or be directed to a crafted pgAdmin MFA URL. Crucially, the vendor's description confirms this is a trusted-domain redirect laundering issue - the attacker gains no pgAdmin session access, no database read/write capability, and no privilege escalation. Real-world risk is therefore bounded by the attacker's ability to deliver convincing phishing targeting pgAdmin users specifically during or after their MFA session. EPSS data was not provided in available intelligence, and the CVE is not listed in CISA KEV, making broad automated exploitation unlikely. The reporter PoC is confirmed by vendor regression tests, elevating confidence in exploitability but not exploitation status. The primary risk is credential-phishing follow-on against high-value database administrators who trust the pgAdmin domain.

An attacker identifies a pgAdmin administrator and sends a phishing email containing a link to the target's own pgAdmin instance - e.g., https://pgadmin.corp.internal/mfa/validate?next=https://attacker.example/pgadmin-login - framed as a security notification requiring MFA re-validation. When the administrator clicks the link while authenticated, pgAdmin's MFA validate endpoint processes the 'next' parameter and issues a 302 redirect to the attacker's site, which presents a credential-harvesting page styled like pgAdmin or the organization's SSO portal. The reporter-confirmed PoC demonstrates this exact flow, and the upstream regression test suite validates that attacker.example must not appear in the resulting Location header.