CVE-2023-22298: pgAdmin 4 Open Redirect Vulnerability
Summary
CVE-2023-22298: pgAdmin 4 Open Redirect vulnerability. Affects pgadmin4 versions < 6.14. Fixed in 6.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin 4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It allows users to manage databases, execute SQL queries, and visualize data. However, prior to version 6.14, pgAdmin 4 is susceptible to an open redirect vulnerability, which can be exploited by attackers to redirect users to malicious websites.
Vulnerability Detail
The open redirect vulnerability in pgAdmin 4 versions before 6.14 allows a remote unauthenticated attacker to manipulate URLs, redirecting users to arbitrary websites. This can lead to phishing attacks, where users may be tricked into providing sensitive information on malicious sites. The vulnerability arises from improper validation of URLs, making it possible for attackers to craft links that appear legitimate but lead to harmful destinations.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.14
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==6.14"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid clicking on untrusted links or URLs that seem suspicious. Educate users about the risks of open redirects and encourage them to verify the authenticity of URLs before accessing them.
Conclusion
The open redirect vulnerability in pgAdmin 4 poses significant risks, allowing attackers to redirect users to malicious sites. It is crucial to update to version 6.14 or later to mitigate these risks. Users should remain vigilant and verify URLs before accessing them to avoid falling victim to phishing attacks.
See every vulnerability recorded for pgadmin4 →
FAQ
An open redirect vulnerability allows attackers to redirect users to any URL, potentially leading to phishing or other malicious activities.
If you are using pgAdmin 4 version prior to 6.14, your installation is vulnerable. You can check your version by running 'pgadmin4 --version' in your terminal.
If updating is not possible, implement strict URL validation in your application and educate users to be cautious with links.
The main consequence is the risk of phishing attacks, where users may be tricked into providing sensitive information on malicious sites.
Vulert monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
