CVE-2026-116238

pgadmin4: pgadmin4: Account takeover via account lockout bypass

pgadmin4

In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: - Flask-Security registers its own views next to pgAdmin's. A login submitted to its /login view was checked and logged in without pgAdmin's failed login count or lock. Its…

30. Okt 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-116238