A major security vulnerability has been discovered in PgAdmin, the widely used open source platform for managing and deploying PostgreSQL databases .
See also: Qualys confirms data breach via Salesloft Drift
The vulnerability, documented as CVE-2025-9636, affects all versions of pgAdmin up to and including 9.7, potentially allowing remote attackers to gain unauthorized access to user accounts and the sensitive data they manage.
The root of the problem lies in an improperly configured Cross-Origin Opening Isolation Policy (COOP). This security feature is designed to isolate a web application window from other windows, preventing malicious pages from interacting with it.
In affected versions of pgAdmin, this policy was not implemented correctly, creating an opening for attackers to manipulate the OAuth authentication flow.
OAuth is a standard protocol used for secure authorization, often seen in features like “Sign in with Google” or “Sign in with GitHub”.
An attacker could exploit this vulnerability by tricking a user into clicking a specially crafted link. This link would open the pgAdmin login page in a new browser window while the attacker's malicious page would remain active in the original window.
Due to the misconfiguration of COOP, the attacker's page can maintain a reference to the pgAdmin window and interfere with the authentication process.
See also: GhostAction campaign steals 3325 secrets in GitHub attack
If the user then proceeds to log in using an OAuth, the attacker can intercept the authentication token, effectively hijacking the session.
Successful exploitation of this vulnerability poses serious risks to organizations and their data. The main consequences include:
– Unauthorized Account Access: An attacker could gain control of a legitimate pgAdmin user’s session, granting them the same level of access as the victim.
– Data Breaches: Once logged in, an attacker could view, modify, or extract sensitive information from any PostgreSQL database connected to the compromised pgAdmin installation.
– Account Takeover: The vulnerability could be exploited to completely take over an account, locking out the legitimate user.
– Privilege Escalation: If the taken over account has administrative privileges, the attacker could potentially escalate its access within the database or even the underlying server infrastructure.
The pgAdmin development team responded immediately to the issue. An update has been released that fixes the COOP header configuration, closing the security hole. The fix is detailed in a commit on the project's official GitHub repository. All users of pgAdmin versions 9.7 and older are strongly encouraged to update to the latest version immediately to protect their systems from potential attacks.
See also: Salesloft Drift attack linked to GitHub breach
Administrators should prioritize applying this update to all pgAdmin installations within their environments to prevent unauthorized access and protect their database assets.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
