Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-12049— pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pgadmin 4是pgAdmin组织开源的一款数据库管理工具。 pgAdmin 4 6.0版本至9.16之前版本存在输入验证错误漏洞，该漏洞源于多因素身份验证流程中对用户提供的'next'参数验证不足，可能导致开放重定向，使已认证用户通过钓鱼链接被重定向到攻击者控制的站点，增加凭据钓鱼成功率。以下版本受到影响：6.0版本至9.16之前版本。

CVSS 4.3 · Medium EPSS 0.38% · P31

Affected Version Matrix 1

VendorProduct Version RangeStatus
pgadmin.org pgAdmin 4 6.0< 9.16 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-12049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter without confirming the target pointed back inside pgAdmin, so an authenticated victim who clicked /mfa/validate?next=<external> -- a link typically delivered by phishing -- would be sent to an attacker-controlled host directly out of the trusted auth flow. The defect is a trusted-domain redirect, not a privilege bypass: the attacker gains no read/write access to pgAdmin or the victim's database, but the redirect launders the attacker's destination through pgAdmin's URL, which raises the success rate of credential-phishing follow-on against the victim. Fix introduces a same-origin _is_safe_redirect_url helper and gates every MFA redirect that consumes user-supplied 'next' values through it. The helper allows only relative paths and absolute URLs whose scheme is http(s) and whose host matches the current request host; it rejects external hosts in absolute and protocol-relative form, non-http schemes (javascript:, data:, mailto:), userinfo tricks (http://localhost@attacker/), and backslash variants that some browsers normalize to forward slashes. Unsafe targets fall back to the internal browser index. A dedicated regression test exercises each accept/reject category and the original reporter PoC. This issue affects pgAdmin 4: from 6.0 before 9.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
pgAdmin 4 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pgadmin 4是pgAdmin组织开源的一款数据库管理工具。 pgAdmin 4 6.0版本至9.16之前版本存在输入验证错误漏洞，该漏洞源于多因素身份验证流程中对用户提供的'next'参数验证不足，可能导致开放重定向，使已认证用户通过钓鱼链接被重定向到攻击者控制的站点，增加凭据钓鱼成功率。以下版本受到影响：6.0版本至9.16之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 6.0 ~ 9.16 -

II. Public POCs for CVE-2026-12049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12049

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-12049 (2)

Same Patch Batch · pgadmin.org · 2026-06-18 · 7 CVEs total

CVE-2026-12048 9.3 CRITICAL pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-p
CVE-2026-12045 9.0 CRITICAL pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote
CVE-2026-12046 9.0 CRITICAL pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection
CVE-2026-12044 8.8 HIGH pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog temp
CVE-2026-12050 4.3 MEDIUM pgAdmin 4: SQL injection in named restore point endpoint
CVE-2026-12047 3.5 LOW pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised S

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-601

V. Comments for CVE-2026-12049

No comments yet

Leave a comment