CVE-2025-9636: pgAdmin4 Cross-Origin Opener Policy Vulnerability
Summary
CVE-2025-9636: pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. Affects pgadmin4 versions < 9.8. Fixed in 9.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It allows users to manage databases, execute SQL queries, and visualize data. However, versions up to 9.7 are vulnerable to a Cross-Origin Opener Policy (COOP) issue, which can lead to serious security risks.
Vulnerability Detail
The vulnerability in pgAdmin4 arises from improper handling of the Cross-Origin Opener Policy (COOP). This flaw allows attackers to manipulate the OAuth flow, potentially leading to unauthorized account access, account takeover, data breaches, and privilege escalation. The vulnerability is classified under CWE-346, indicating a weakness in the authentication mechanism.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.8
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.8"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the application by implementing additional security layers, such as using a VPN or firewall rules to limit exposure to trusted networks only.
Conclusion
In summary, pgAdmin4 versions up to 9.7 are vulnerable to a significant Cross-Origin Opener Policy issue that can lead to severe security risks. Users are strongly advised to upgrade to version 9.8 or later to protect their applications from potential attacks.
See every vulnerability recorded for pgadmin4 →
FAQ
The CVSS score of this vulnerability is 7.9, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized account access, account takeover, data breaches, and privilege escalation.
Yes, a patch is available in version 9.8 of pgAdmin4. Users should upgrade to this version to mitigate the risk.
The Cross-Origin Opener Policy is a security feature that helps prevent cross-origin attacks by controlling how documents and windows can interact with each other.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
