CVE-2025-9636
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
CVE-2025-9636- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2025-26729
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
EUVD-2025-26729- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6859-2qxq-ffv2
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
GHSA-6859-2qxq-ffv2- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
CVE-2025-9636- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
OSV
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
CVE-2025-9636- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVGHSA-6859-2qxq-ffv2
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
GHSA-6859-2qxq-ffv2- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
Show 4 moreShow less
OSVPYSEC-2026-1769
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
- Record
PYSEC-2026-1769- CVSS 3.1
- 7.9 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15612-1 No score
pgadmin4-9.8-1.1 on GA media
These are all security issues fixed in the pgadmin4-9.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15612-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03625-1 No score
Security update for pgadmin4
This update for pgadmin4 fixes the following issues:
- CVE-2025-9636: Fixed cross-origin opener policy (COOP) vulnerability (bsc#1249151).
- Record
SUSE-SU-2025:03625-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:0232-1 No score
Security update for pgadmin4
This update for pgadmin4 fixes the following issues:
- CVE-2025-9636: Fixed Cross-Origin Opener Policy (COOP) vulnerability (bsc#1249151).
- Record
SUSE-SU-2026:0232-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgadmin4PyPI |
before 9.8 | 9.8 |
pgadmin4PyPI |
before 9.8, plus listed versions 4.204.224.234.244.25 Show 45 moreShow less4.264.274.284.294.305.05.15.25.35.45.55.65.76.106.116.126.136.146.156.166.176.186.196.26.206.216.36.46.56.66.76.86.97.07.17.27.37.47.57.67.77.88.08.18.10 |
9.8 |
pgadmin4SUSE:Linux Enterprise Module for Python 3 15 SP6 |
before 8.5-150600.3.15.1 | 8.5-150600.3.15.1 |
pgadmin4SUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 8.5-150600.3.15.1 | 8.5-150600.3.15.1 |
pgadmin4openSUSE:Leap 15.6 |
before 8.5-150600.3.15.1 | 8.5-150600.3.15.1 |
pgadmin4SUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
pgadmin4SUSE:Linux Enterprise Server 15 SP4-LTSS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise Server 15 SP5-LTSS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise Server 15 SP6-LTSS |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4SUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 4.30-150300.3.24.1 | 4.30-150300.3.24.1 |
pgadmin4openSUSE:Tumbleweed |
before 9.8-1.1 | 9.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-9636 is a high vulnerability (CVSS 7.9) in Pgadmin 4, published September 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in pgadmin4 9.8.
References
github.com/pgadmin-org/pgadmin4/issues/9114
nvd.nist.gov/vuln/detail/CVE-2025-9636
Left out here: 20 versions. The JSON record has them.