High severity · published Sep 4, 2025
CVE-2025-9636
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
7.9
CVSS
0.2%
EPSS
No
On KEV
Description
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P4
pgAdmin 4 · pgadmin.org
before 9.8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9636
Issue Tracking
https://github.com/pgadmin-org/pgadmin4/issues/9114
More from pgAdmin 4
9.9
CVE-2026-17566
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
9.9
CVE-2026-7813
pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode
9.8
CVE-2026-86863
pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
9.8
CVE-2025-12762
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
9.6
CVE-2026-17349
pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner