{"id":"CVE-2024-9014","aliases":["EUVD-2024-2825","GHSA-jm9x-rx9x-wpqj","PYSEC-2026-1775","SUSE-SU-2024:3771-1","openSUSE-SU-2025:14983-1"],"status":"published","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.09685,"percentile":0.95536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-522"],"published":"2024-09-23T17:04:00Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"pocgithub","id":"EQSTLab/CVE-2024-9014","title":"EQSTLab/CVE-2024-9014","date":"2024-09-26","url":"https://github.com/EQSTLab/CVE-2024-9014"},{"source":"pocgithub","id":"r0otk3r/CVE-2024-9014","title":"r0otk3r/CVE-2024-9014","date":"2025-07-08","url":"https://github.com/r0otk3r/CVE-2024-9014"},{"source":"nuclei","id":"CVE-2024-9014","title":"pgAdmin 4 - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9014.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"pgadmin4","fixed_in":["8.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9"]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2-1.1"}]}],"bundled":4}],"products":[{"vendor":"pgadmin","product":"pgadmin_4"},{"vendor":"pgadmin.org","product":"pgadmin 4"},{"vendor":"postgresql","product":"pgadmin_4"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7945","tags":["issue-tracking","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9014","tags":["advisory"]},{"url":"https://www.pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jm9x-rx9x-wpqj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9014.json","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":["package"]},{"url":"https://pypi.org/project/pgadmin4","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BYON52PV4P44MGBG55FDOG2SP2G266ZO/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-9014","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T17:04:00.264Z","modified":"2024-09-23T19:21:22.348Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:34:06.147811Z"}],"euvd":[{"id":"EUVD-2024-2825","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T17:04:00Z","modified":"2024-09-23T19:21:22Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:28:16.548139Z"}],"ghsa":[{"id":"GHSA-jm9x-rx9x-wpqj","title":"OAuth2 client ID and secret exposed through the web browser","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T18:30:34Z","modified":"2024-10-01T20:35:11Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:38:07.852618Z"}],"nvd":[{"id":"CVE-2024-9014","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T17:15:14Z","modified":"2026-06-17T08:23:47.323Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:10:27.456509Z"}],"osv":[{"id":"CVE-2024-9014","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T17:04:00.264Z","modified":"2026-10-28T02:31:10.409724581Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"GHSA-jm9x-rx9x-wpqj","title":"OAuth2 client ID and secret exposed through the web browser","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2024-09-23T18:30:34Z","modified":"2026-07-07T17:56:43.843490929Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"PYSEC-2026-1775","title":"OAuth2 client ID and secret exposed through the web browser","description":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","status":"published","published":"2026-07-07T14:34:42.368977Z","modified":"2026-07-07T17:48:01.145639245Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"openSUSE-SU-2025:14983-1","title":"pgadmin4-9.2-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-9.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2026-02-04T03:09:54.490239Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}