CVE-2026-7820

Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4. pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/login view. Flask-Security's default /login view, which is registered automatically by security.init_app() and is reachable on every server, never consulted the User.locked field: pgAdmin's User model relied on Flask-Security's UserMixin.is_locked() (which always returns 'not locked') and Flask-Login's is_active (which only checks the active column, not locked). An attacker who triggered an account lockout via /authenticate/login could therefore obtain a session by re-submitting valid credentials directly to /login, defeating the brute-force-protection control for accounts using the INTERNAL authentication source. The same bypass also means that login attempts via /login are never rate-limited, so an attacker can perform an unbounded online password-guessing attack against INTERNAL accounts regardless of MAX_LOGIN_ATTEMPTS. Fix overrides User.is_active and User.is_locked() so the locked column is enforced on every authentication path. LDAP, OAuth2, Kerberos, and Webserver users are not reachable by this bypass because they have no local password and are rejected by Flask-Security's LoginForm.validate before the locked check; the lockout itself is also internal-only (the /authenticate/login view filters by auth_source=INTERNAL). This issue affects pgAdmin 4: before 9.15.

• CWE-307

• https://github.com/pgadmin-org/pgadmin4/issues/9904Issue Tracking, Patch, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7819Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 F…8.1
• CVE-2026-78195Rejected reason: Rejecting as a duplicate of CVE-2026-78047
• CVE-2026-78196A security flaw has been discovered in achorein expo-share-i…4.4
• CVE-2026-78197A weakness has been identified in SourceCodester Simple Onli…7.3
• CVE-2026-78198A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-78199A vulnerability was detected in SourceCodester Simple Online…7.3
• CVE-2026-78200A flaw has been found in itsourcecode Library Management Sys…6.3
• CVE-2026-78201A vulnerability has been found in itsourcecode Payroll Syste…7.3
• CVE-2026-78202A vulnerability was found in itsourcecode Payroll System 1.0…7.3
• CVE-2026-78203Ghostwriter before 7.1.2 fails to validate template ownershi…7.1
• CVE-2026-78204Ghostwriter through 7.2.6 does not apply per-object authoriz…5.4
• CVE-2026-78205BentoML's outbound connection safeguard (make_safe_connect i…5.8