CVE-2025-9636 Cross-Origin Opener Policy Vulnerability in pgAdmin 4
Attackers can bypass Cross-Origin Opener Policy to manipulate OAuth flows, leading to unauthorized account access and privilege escalation in pgAdmin 4.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-9636?
CVE-2025-9636 is a high-severity vulnerability in pgadmin.org pgAdmin 4, published on 4 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
Weakness: CWE-346
Which versions are affected by CVE-2025-9636?
3 open source packages ship an affected version, including pgadmin4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 9.8 |
pgadmin4 PyPI | All versions | 9.8 |
pgadmin4 PyPI | All versions | 9.8 |
Linux distribution packages (15)
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Module for Python 3 15 SP6 | All versions | 8.5-150600.3.15.1 |
pgadmin4 SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 8.5-150600.3.15.1 |
pgadmin4 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 4.30-150300.3.24.1 |
pgadmin4 SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 4.30-150300.3.24.1 |
pgadmin4 openSUSE:Leap 15.6 | All versions | 8.5-150600.3.15.1 |
pgadmin4 openSUSE:Tumbleweed | All versions | 9.8-1.1 |
Products include Pgadmin Pgadmin 4.
How do I fix CVE-2025-9636?
Upgrade pgadmin4 to 9.8 or later.
Is CVE-2025-9636 being exploited?
There is no known exploitation of CVE-2025-9636 in the wild and no public exploit code.
Other vulnerabilities in pgadmin.org pgAdmin 4
- CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-17351 SQL injection in pgAdmin 4
- CVE-2026-17566 Command injection in pgAdmin 4
Sources
Also known as GHSA-6859-2qxq-ffv2, PYSEC-2026-1769, SUSE-SU-2025:03625-1, SUSE-SU-2026:0232-1, openSUSE-SU-2025:15612-1.