CVE-2026-7820

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description Improper restriction of excessive authentication attempts occurs because the MAX LOGIN ATTEMPTS setting is only enforced within the custom '/authenticate/login' endpoint. The default '/login' endpoint provided by Flask-Security does not check the User.locked field, relying instead on UserMixin.is locked() and is active, which do not properly validate the locked status. This allows an attacker to bypass brute-force protection for accounts using the INTERNAL authentication source by submitting credentials directly to the '/login' endpoint, enabling unbounded online password-guessing attacks. This issue does not affect users authenticated via LDAP, OAuth2, Kerberos, or Webserver as they lack local passwords.

Recommendations Update pgAdmin 4 to version 9.15 or later.