CVE-2026-12049: pgAdmin 4 Open Redirect in MFA Flow

Technical summary

The vulnerability exists in pgAdmin 4's MFA validate and register endpoints, which consume an unauthenticated user-supplied 'next' query or form parameter and redirect to its value without origin validation. The flaw allows absolute URLs with external hosts, protocol-relative URLs, and data/javascript schemes to pass through. The fix implements a same-origin redirect validator (_is_safe_redirect_url) that permits only relative paths and absolute http/https URLs whose hostname matches the current request host. The helper explicitly rejects external hostnames, protocol-relative references, non-http schemes, userinfo-based tricks (e.g., http://[email protected]/), and backslash normalization bypasses. Failed validation falls back to the internal browser index. Regression tests cover both accept and reject categories and the original proof-of-concept.

Business impact

The risk is primarily reputational and social-engineering amplification. Because the redirect flows through pgAdmin's trusted domain, phishing attacks gain legitimacy—victims see pgAdmin's URL in their browser before being redirected, lowering their guard. For organizations relying on pgAdmin for database administration, this increases the likelihood that MFA-completing users will surrender credentials to follow-on phishing campaigns. There is no direct data breach or unauthorized database access from the redirect itself; impact depends on successful credential harvesting after the redirect.

Affected systems

pgAdmin 4 versions 6.0 through 9.15 (inclusive) are vulnerable. The fix is available in version 9.16 and later. pgAdmin 5.x and earlier versions, as well as pgAdmin 3.x, fall outside the stated affected range and do not require patching for this issue.

Exploitability

Exploitation requires user interaction—the victim must click an attacker-supplied link while authenticated to pgAdmin, typically delivered via phishing email or chat. No special network position, elevated privilege, or complex technical steps are required; the attack surface is the MFA flow itself, which is public-facing. The CVSS 3.1 base score of 4.3 (Medium) reflects the requirement for user interaction and limited direct impact (integrity only, no confidentiality or availability loss from the redirect itself). Post-redirect phishing success depends on social engineering sophistication.

Remediation

Upgrade pgAdmin 4 to version 9.16 or later. The patch is backward-compatible and introduces no breaking changes to the MFA user experience. Organizations should prioritize this update for any pgAdmin instance accessible from untrusted networks or used by phishing-vulnerable staff. Temporary mitigation without patching is limited; restricting access to pgAdmin to a VPN or IP allowlist reduces phishing link viability but does not eliminate the redirect itself.

Patch guidance

Apply pgAdmin 4 version 9.16 or later. Verify the upgrade via the pgAdmin About or Settings panel (typically shows version number). No database migration or configuration changes are required. Test MFA flow after patching to confirm redirect behavior returns users to the pgAdmin UI rather than external sites. If running pgAdmin in a container, ensure base images are updated and redeployed.

Detection guidance

Monitor pgAdmin logs for MFA validation/registration requests containing 'next' parameters with external hostnames or non-http schemes. Web application firewalls (WAF) can detect and block requests to the /mfa/validate and /mfa/register endpoints if the 'next' parameter contains external domains. Endpoint Detection and Response (EDR) tools may flag user sessions that complete MFA and immediately connect to suspicious external hosts. Search historical logs for patterns: /mfa/validate?next=http(s)://<external-domain> or /mfa/register?next=javascript: to identify past exploitation attempts.

Why prioritize this

Although the CVSS score is Medium (4.3), this vulnerability deserves prompt attention because it directly enables phishing campaigns against authenticated administrative users. pgAdmin is often a critical database access point; compromised credentials could lead to lateral movement, data exfiltration, or production disruption. The fix is low-risk and widely available. Organizations with pgAdmin exposed to the internet or used by staff in high-phishing environments should patch within 30 days.

Risk score, explained

The CVSS 3.1 base score of 4.3 reflects: (1) network-accessible attack vector; (2) low attack complexity (simple URL crafting); (3) no privilege required; (4) required user interaction (clicking a malicious link); (5) limited scope (integrity only—user is redirected, not a system compromise); (6) no confidentiality or availability impact from the redirect itself. The score does not account for downstream phishing success, which is context-dependent and outside the vulnerability's direct scope. In practice, risk may be higher for organizations with high-value targets or poor phishing awareness.

Frequently asked questions