CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
Attackers can expose OAuth2 client credentials via the browser, enabling unauthorized access to user data in pgAdmin 4.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9014?
CVE-2024-9014 is a critical vulnerability in pgadmin.org pgAdmin 4, published on 23 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.
Weakness: CWE-522
Which versions are affected by CVE-2024-9014?
3 open source packages ship an affected version, including pgadmin4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 8.12 |
pgadmin4 PyPI | All versions | 8.12 |
pgadmin4 PyPI | All versions | 8.12 |
Products include Pgadmin Pgadmin 4.
How do I fix CVE-2024-9014?
Upgrade pgadmin4 to 8.12 or later.
Is CVE-2024-9014 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9014 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in pgadmin.org pgAdmin 4
- CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-17351 SQL injection in pgAdmin 4
- CVE-2026-17566 Command injection in pgAdmin 4
- CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
Sources
Also known as GHSA-jm9x-rx9x-wpqj, PYSEC-2026-1775.