Skip to content
Sign in
7.4 High

CVE-2024-4215 pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability

Description

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

Affected products and versions

Product Affected versions Fixed in
pgAdmin 4 8.6 earliest → < 8.6 8.6
pgadmin 8.5 earliest → 8.5 No fix stated

Other CVEs of pgAdmin 4

The 56 CVEs of pgAdmin 4 →
CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged 6.5 Medium CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own… 4.2 Medium CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file… 8.4 High CVE-2026-116250 In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with… 6.5 Medium
Track this CVE