Authentication Bypass in pgAdmin 4 by pgAdmin Development Team

CVE-2026-7820

What is CVE-2026-7820?

An authentication bypass vulnerability exists in pgAdmin 4 due to improper rate limiting on login attempts. The MAX_LOGIN_ATTEMPTS control is enforced only on the custom login view, leaving the default Flask-Security login view exposed to brute force attacks. An attacker could bypass account lockouts by exploiting the /login endpoint, which doesn't check the user's lock status properly. This oversight allows unbounded online password-guessing attempts against accounts using the INTERNAL authentication source, potentially compromising user security. The fix ensures all authentication paths enforce user account status correctly.

References