CVE-2025-9636
Fixed in a distro release EPSS <1%CVSS 7.9
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
Products: pgadmin.org pgAdmin 4
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pgadmin4 | 9.8 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | pgadmin4 | 8.5-150600.3.15.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | pgadmin4 | 8.5-150600.3.15.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | pgadmin4 | 4.30-150300.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | pgadmin4 | 4.30-150300.3.24.1 |
| openSUSE Leap 15.6 | pgadmin4 | 8.5-150600.3.15.1 |
| openSUSE Tumbleweed | pgadmin4 | 9.8-1.1 |