What’s Vulnerable › Vulnerabilities

CVE-2024-4215: The Multi Factor Authentication bypass vulnerability in pgAdmin 4

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-02 · updated 2026-06-17
• Weakness: CWE-89

Description

pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’s username and password may authenticate to the application and perform sensitive actions within the application, such as managing files and executing SQL queries, regardless of the account’s MFA enrollment status.

Affected products

• Fedoraproject Fedora: 40
• pgadmin.org pgAdmin 4: before 8.6 — fixed in 8.6

How to fix

Upgrade to a fixed version: pgadmin.org pgAdmin 4 8.6. Check the vendor advisory for mitigations.

References

• https://github.com/pgadmin-org/pgadmin4/issues/7425
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/
• https://github.com/pgadmin-org/pgadmin4/issues/7425
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE/

Get alerted when CVE-2024-4215 or the next vulnerability affects your stack