Multi-Factor Authentication Bypass Vulnerability in pgAdmin4
Summary
CVE-2024-4215: pgAdmin is affected by a multi-factor authentication bypass vulnerability. Affects pgadmin4 versions < 8.6. Fixed in 8.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is an open-source administration and development platform for PostgreSQL databases. It provides a web-based interface for managing databases, executing SQL queries, and performing various administrative tasks. pgAdmin4 is widely used by developers and database administrators to interact with PostgreSQL databases.
Vulnerability Detail
pgAdmin4 version 8.5 and below are affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker who knows a legitimate user's username and password to authenticate to the application and perform sensitive actions, such as managing files and executing SQL queries, regardless of the account's MFA enrollment status. The vulnerability poses a significant risk as it allows unauthorized access to the application and potentially sensitive data.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.6
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==8.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to ensure the security of the pgAdmin4 application.
Conclusion
The multi-factor authentication bypass vulnerability in pgAdmin4 version 8.5 and below poses a significant risk to the security of the application and the underlying databases. Users should upgrade to version 8.6 or later to fix the vulnerability and ensure the integrity of their pgAdmin4 installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pgadmin4 →
FAQ
pgAdmin4 is an open-source administration and development platform for PostgreSQL databases. It provides a web-based interface for managing databases, executing SQL queries, and performing various administrative tasks.
The vulnerability allows an attacker with knowledge of a legitimate user's username and password to bypass multi-factor authentication and gain unauthorized access to the pgAdmin4 application. This can lead to unauthorized actions, such as managing files and executing SQL queries, potentially compromising the security of the application and the underlying databases.
To fix this vulnerability, users should upgrade their pgAdmin4 installation to version 8.6 or later. The latest version includes a patch that addresses the multi-factor authentication bypass vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version to mitigate the risk.
Users can download the latest version of pgAdmin4 from the official pgAdmin website or use package managers like pip to update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
