Every CVE Search/ Get API key

CVE-2024-9014

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

9.9 CriticalPublic exploitFix available

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

9.69%Up 9.6 points since Sep 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.9

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
CVE-2024-9014
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-522
Updated
2026-11-02
EUVDEUVD-2024-2825 9.9

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
EUVD-2024-2825
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-jm9x-rx9x-wpqj 8.6

OAuth2 client ID and secret exposed through the web browser

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
GHSA-jm9x-rx9x-wpqj
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
NVD 9.9

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
CVE-2024-9014
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSV 9.9

OAuth2 client id and secret exposed through the web browser in pgAdmin 4

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
CVE-2024-9014
CVSS 3.1
9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-jm9x-rx9x-wpqj 8.6

OAuth2 client ID and secret exposed through the web browser

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
GHSA-jm9x-rx9x-wpqj
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-522
Updated
2026-11-02
OSVPYSEC-2026-1775 8.6

OAuth2 client ID and secret exposed through the web browser

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

Record
PYSEC-2026-1775
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2025:14983-1 No score

pgadmin4-9.2-1.1 on GA media

These are all security issues fixed in the pgadmin4-9.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14983-1
Updated
2026-11-02
OSVSUSE-SU-2024:3771-1 No score

Security update for pgadmin4

This update for pgadmin4 fixes the following issues:

  • CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
  • CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
  • CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
  • CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
  • CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
  • CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
  • CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
  • CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
  • CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
  • CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)
Record
SUSE-SU-2024:3771-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pgadmin4
PyPI
 before 8.12
8.12
pgadmin4
PyPI
 before 8.12, plus listed versions
4.204.224.234.244.25
Show 45 moreShow less
4.264.274.284.294.305.05.15.25.35.45.55.65.76.106.116.126.136.146.156.166.176.186.196.26.206.216.36.46.56.66.76.86.97.07.17.27.37.47.57.67.77.88.08.18.10
8.12
pgadmin4
SUSE:Linux Enterprise Module for Python 3 15 SP6
From an advisory covering 10 CVEs
 before 8.5-150600.3.6.1
8.5-150600.3.6.1
pgadmin4
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 8.5-150600.3.6.1
8.5-150600.3.6.1
pgadmin4
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 9.2-1.1
9.2-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubEQSTLab/CVE-2024-90142024-09-26
PoC in GitHubr0otk3r/CVE-2024-90142025-07-08
NucleipgAdmin 4 - Authentication Bypass

History

History
RecordedChangedSources
affected, exploits, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-9014 is a critical vulnerability (CVSS 9.9) in Pgadmin 4, published September 23, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.69%, the 95th percentile. Fixed in pgadmin4 8.12.

References

Show 26 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open