pgAdmin 4: Login as another account with the same username (LDAP/Kerberos)
Summary
In server mode, pgAdmin 4 can log an LDAP or Kerberos user into an internal account with the same username, including the initial administrator account. The session then has the role, servers and saved database passwords of that other account. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. Desktop mode is not affected.
Affected
- pgAdmin 4 server mode before 9.19
- Desktop mode is not affected
Fixed in
- Fixed in pgAdmin 4 version 9.19 (released 2026-10-29)
Workaround
- Unknown. No vendor-documented workaround. Disabling LDAP or Kerberos authentication until patching may reduce the risk, but this has not been verified.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- No public proof of concept found. The vendor fix commits and tracking issue are public.
Our recommendation
- Upgrade pgAdmin 4 server mode to version 9.19 or later. The release also fixes 15 other CVEs, so treat it as one upgrade.
- Until patched, check which deployments use LDAP or Kerberos authentication and restrict access to them.
- Review logins to the administrator account and to accounts with the same username as LDAP or Kerberos users.
- Monitor authentication logs for unexpected logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- pgAdmin fix commit 269e32d (Kerberos and internal authentication) github.com
- pgAdmin fix commit 7378060 (LDAP authentication) github.com
- pgAdmin tracking issue #10675 github.com
- pgAdmin 4 version 9.19 release notes www.pgadmin.org
- PostgreSQL news: pgAdmin 4 v9.19 released www.postgresql.org
- VulDB entry 429376 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:23.
Original description (NVD)
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's login form had looked up, without checking that it came from the source that authenticated the user. The session therefore belonged to another account, with its role, its servers and its saved database passwords: - An LDAP or Kerberos user whose username matched an internal account was logged in as that internal account, including the administrator account created when pgAdmin is first set up. - With internal authentication listed before LDAP or Kerberos in AUTHENTICATION_SOURCES, the login form's internal validation looks up the account whose email was typed and keeps it even though its password does not match. A Kerberos user could type another Kerberos user's principal and be logged in as that user, and an LDAP user could do the same with an LDAP account whose email is their username. Exploitation requires valid credentials for an LDAP directory or Kerberos realm that pgAdmin is configured to use. The fix looks the account up by the authenticated username and the source that authenticated it, and no longer uses the account the login form found for any source but internal authentication. Internal authentication logs in that account only if it is an internal account. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.