CVE-2024-9014: pgAdmin4 OAuth2 Client ID and Secret Exposure Vulnerability
Summary
CVE-2024-9014: OAuth2 client ID and secret exposed through the web browser. Affects pgadmin4 versions < 8.12. Fixed in 8.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, allowing users to manage databases through a web interface. It provides features such as query execution, database design, and user management. However, versions 8.11 and earlier have a critical vulnerability in their OAuth2 authentication mechanism, which can expose sensitive client credentials.
Vulnerability Detail
The vulnerability arises from improper handling of OAuth2 client ID and secret in pgAdmin4 versions 8.11 and earlier. This flaw allows attackers to potentially capture these credentials through the web browser, leading to unauthorized access to user data. The implications of this vulnerability are severe, as it could enable attackers to impersonate legitimate users and manipulate or exfiltrate sensitive information.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.12
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==8.12"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, users can restrict access to the pgAdmin4 application by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to trusted users only. However, upgrading to the latest version is strongly recommended for a permanent fix.
Conclusion
The OAuth2 client ID and secret exposure vulnerability in pgAdmin4 versions 8.11 and earlier poses a significant risk to user data. It is crucial for users to upgrade to version 8.12 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2024-9014 is a vulnerability in pgAdmin4 that exposes OAuth2 client ID and secret, potentially allowing unauthorized access to user data.
pgAdmin4 versions 8.11 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
If immediate upgrading is not possible, implement network-level security measures to restrict access to the pgAdmin4 application until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
