CVE-2026-7820

Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS. Fix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL). This issue affects pgAdmin 4: before 9.15.

• CWE-307

• https://github.com/pgadmin-org/pgadmin4/issues/9904Issue Tracking, Patch, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7814Stored cross-site scripting (XSS) vulnerability in pgAdmin 4…4.8
• CVE-2026-7815SQL injection vulnerability in pgAdmin 4 Maintenance Tool. …8.8
• CVE-2026-7816OS command injection (CWE-78) vulnerability in pgAdmin 4 Imp…8.8
• CVE-2026-7817Local file inclusion (LFI) and server-side request forgery (…7.1
• CVE-2026-7818Deserialization of untrusted data (CWE-502) in pgAdmin 4 Fil…7.8
• CVE-2026-7819Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 F…8.1
• CVE-2026-7821Improper certificate validation in Ivanti EPMM before versio…9.1
• CVE-2026-7822A vulnerability was identified in itsourcecode Courier Manag…6.3
• CVE-2026-7823A security flaw has been discovered in Totolink A8000RU 7.1c…9.8
• CVE-2026-7824An issue was discovered in the PaperCut Hive Ricoh embedded …5.9
• CVE-2026-7828UltraVNC repeater through 1.8.2.2 contains an integer overfl…5.3
• CVE-2026-7829UltraVNC repeater through 1.8.2.2 contains a post-authentica…7.2