CVE-2026-12049

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15

Description An open redirect exists in the multi-factor authentication (MFA) flow. The MFA validate and register endpoints, specifically '/mfa/validate', process the user-supplied next query or form parameter without verifying if the target destination is internal to the application. This allows an authenticated user to be redirected to an attacker-controlled host after clicking a malicious link, which can be used to increase the effectiveness of credential-phishing attacks by making the destination appear to originate from a trusted domain. This issue does not grant the attacker read or write access to the application or the database.

Recommendations Update to version 9.16.