PgAdmin Vulnerability Allows Attackers to Gain Unauthorized Account Access

A newly disclosed security flaw in pgAdmin4, the widely used open-source tool for managing PostgreSQL databases, has raised serious concerns among developers and database administrators worldwide. The vulnerability, tracked as CVE-2025-9636, is described as a Cross-Origin Opener Policy (COOP) flaw that affects pgAdmin versions up to 9.7, with a patched release of 9.8.

According to GitHub Advisory Database, attackers can exploit this flaw during the authentication and OAuth flow to gain unauthorized access, potentially leading to session hijacking or full account takeover. The advisory notes that by manipulating COOP headers, malicious actors can bypass browser protections and bypass normal authentication processes.

The article urges users and organisations relying on pgAdmin to upgrade to 9.8, review current sessions, audit access logs, and consider rotating credentials to mitigate any unauthorized access that may already have occurred.