GHSA-jm9x-rx9x-wpqj

OAuth2 client ID and secret exposed through the web browser

Source: GitHub Advisory Database (reviewed) High CVE-2024-9014

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pgadmin4	< 8.12	8.12

Details

As written in the advisory (Markdown source, shown as plain text).

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-9014 advisory
https://github.com/pgadmin-org/pgadmin4/issues/7945 web
https://github.com/pgadmin-org/pgadmin4 package
https://www.pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.html web