Mai Phạm Hiền

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 6.0 through 9.15 **Description** An open redirect exists in the multi-factor authentication (MFA) flow. The MFA validate and register endpoints, specifically '/mfa/validate', process the user-supplied `next` query or form parameter without verifying if the target destination is internal to the application. This allows an authenticated user to be redirected to an attacker-controlled host after clicking a malicious link, which can be used to increase the effectiveness of credential-phishing attacks by making the destination appear to originate from a trusted domain. This issue does not grant the attacker read or write access to the application or the database. **Recommendations** Update to version 9.16.