PYSEC-2026-1769

pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability

En bref

Publiée: 2026-07-07 16:03 UTC
Mise à jour: 2026-07-07 17:47 UTC
CVE: CVE-2025-9636
Alias: GHSA-6859-2qxq-ffv2
CVSS_V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

Description

pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.

Paquets affectés

Paquet	Versions
PyPI · pgadmin4	introduced 0, fixed 9.8

Références

https://nvd.nist.gov/vuln/detail/CVE-2025-9636 ADVISORY
https://github.com/pgadmin-org/pgadmin4/issues/9114 WEB
https://github.com/pgadmin-org/pgadmin4/commit/cdeb18fcbb139a200b5a4779c82f9cd1aaaf3c89 WEB
https://github.com/pgadmin-org/pgadmin4 PACKAGE
https://pypi.org/project/pgadmin4 PACKAGE
https://github.com/advisories/GHSA-6859-2qxq-ffv2 ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database