Open Redirect Vulnerability in pgAdmin 4's Multi-Factor Authentication Flow

CVE-2026-12049

What is CVE-2026-12049?

An open redirect issue in pgAdmin 4's multi-factor authentication flow allows attackers to manipulate the 'next' query parameter used during authentication. By crafting a link that directs users to an external site under the guise of a legitimate pgAdmin redirect, attackers increase the likelihood of successful phishing attacks. Although this vulnerability does not grant access to pgAdmin or the victim's database, it effectively masks the attacker-controlled destination within pgAdmin's URL, thereby posing a significant security risk. The recent fix introduces stringent checks via a new helper function that only permits safe redirects to the current origin, significantly reducing the attack surface.

References