critical9.9
CVE-2024-9014
OAuth2 client ID and secret exposed through the web browser
Impact
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pgadmin4 | < 8.12 | 8.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pgadmin | Pgadmin 4 | before 8.12 |