Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2024-9014

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

Description

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pgadmin.org pgAdmin 4

Default version status: affected

  • 0 to < 8.12affected

References