{"id":"CVE-2025-9636","aliases":["EUVD-2025-26729","GHSA-6859-2qxq-ffv2","PYSEC-2026-1769","SUSE-SU-2025:03625-1","SUSE-SU-2026:0232-1","openSUSE-SU-2025:15612-1"],"status":"published","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","severity":{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00227,"percentile":0.13455,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2025-09-04T16:43:27Z","modified":"2026-10-28T02:30:47Z","fixes":[{"ecosystem":"PyPI","package":"pgadmin4","fixed_in":["9.8"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","fixed_in":["8.5-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"pgadmin4","fixed_in":["8.5-150600.3.15.1","4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","fixed_in":["8.5-150600.3.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"pgadmin4","fixed_in":["4.30-150300.3.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","fixed_in":["9.8-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.2","9.3","9.4","9.5","9.6","9.7"]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.2","9.3","9.4","9.5","9.6","9.7"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.30-150300.3.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.8-1.1"}]}]}],"products":[{"vendor":"pgadmin","product":"pgadmin_4"},{"vendor":"pgadmin.org","product":"pgadmin 4"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/9114","tags":["issue-tracking","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9636","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/cdeb18fcbb139a200b5a4779c82f9cd1aaaf3c89","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6859-2qxq-ffv2","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9636.json","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":["package"]},{"url":"https://pypi.org/project/pgadmin4","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503625-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249151","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260232-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-9636","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-04T16:43:27.71Z","modified":"2026-02-26T17:49:38.292Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:32:34.096798Z"}],"euvd":[{"id":"EUVD-2025-26729","description":"pgAdmin \u003c= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-04T16:43:27Z","modified":"2026-02-26T17:49:38Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:20.263706Z"}],"ghsa":[{"id":"GHSA-6859-2qxq-ffv2","title":"pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability","description":"pgAdmin \u003c= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-05T18:31:17Z","modified":"2025-09-05T21:12:53Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-9636","description":"pgAdmin \u003c= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-04T17:15:39.67Z","modified":"2026-06-17T10:09:25.47Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:11:27.145738Z"}],"osv":[{"id":"CVE-2025-9636","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","description":"pgAdmin \u003c= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-04T16:43:27.71Z","modified":"2026-10-28T02:30:47.932353093Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"GHSA-6859-2qxq-ffv2","title":"pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability","description":"pgAdmin \u003c= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2025-09-05T18:31:17Z","modified":"2026-07-07T17:56:56.925930391Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"PYSEC-2026-1769","title":"pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability","description":"pgAdmin \u003c= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","status":"published","published":"2026-07-07T16:03:03.43354Z","modified":"2026-07-07T17:47:18.623335235Z","cvss":[{"version":"3.1","score":7.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"openSUSE-SU-2025:15612-1","title":"pgadmin4-9.8-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-9.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-08T00:00:00Z","modified":"2026-03-23T04:54:00.460439Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:03625-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-9636: Fixed cross-origin opener policy (COOP) vulnerability (bsc#1249151).\n","status":"published","published":"2025-10-17T06:12:43Z","modified":"2026-02-04T02:22:36.210518Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2026:0232-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2025-9636: Fixed Cross-Origin Opener Policy (COOP) vulnerability (bsc#1249151).\n","status":"published","published":"2026-01-22T12:24:10Z","modified":"2026-03-23T04:52:03.137136Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}