{"id":"CVE-2024-9014","published":"2024-09-23T17:04:00Z","modified":"2024-09-23T19:21:22Z","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"core","eol":null,"affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 8.12"]}],"description":{"text":"pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the OAuth2 authentication component of pgAdmin 4, where the OAuth2 client ID and client secret can be exposed through the web browser. An attacker who can reach the affected pgAdmin 4 instance over the network with a low-privileged account could obtain these credentials without user interaction, potentially gaining unauthorized access to user data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:53Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.09685,"percentile":0.95496,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-10-07","exploitedFirstSeen":"2024-10-07","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-07&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-12&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-13&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-14&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-15&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-16&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-18&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-21&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-25&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-26&host_type=src&vulnerability=cve-2024-9014","date":"2024-10-26"}],"evidenceTotal":478,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7945","tags":["issue-tracking"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<8.12"],"patched":["8.12"],"from":["GHSA-jm9x-rx9x-wpqj","PYSEC-2026-1775"],"provenance":"source"}],"advisories":[{"id":"GHSA-jm9x-rx9x-wpqj","url":"https://github.com/advisories/GHSA-jm9x-rx9x-wpqj","severity":"HIGH","ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<8.12"],"patched":["8.12"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-2825","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2825","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2024-09-26","earliestUrl":"https://github.com/EQSTLab/CVE-2024-9014","repos":[{"name":"EQSTLab/CVE-2024-9014","url":"https://github.com/EQSTLab/CVE-2024-9014","stars":8,"created":"2024-09-26"}]},"nuclei":[{"id":"CVE-2024-9014","name":"pgAdmin 4 - Authentication Bypass","severity":"critical","path":"http/cves/2024/CVE-2024-9014.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9014.yaml"}],"first":{"date":"2024-09-26","source":"PoC-in-GitHub","url":"https://github.com/EQSTLab/CVE-2024-9014"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-09-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-9014","provenance":"source"},{"date":"2024-09-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/EQSTLab/CVE-2024-9014","provenance":"source"},{"date":"2024-10-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-10-07&host_type=src&vulnerability=cve-2024-9014","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 754 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.1,"detail":"percentile 0.9550"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2023-5002","published":"2023-09-22","fixed":"7.7","kev":false},{"cve":"CVE-2024-3116","published":"2024-04-04","fixed":"8.5","kev":false},{"cve":"CVE-2024-4215","published":"2024-05-02","fixed":"8.6","kev":false,"link":{"from":"CVE-2024-4215","to":"CVE-2024-9014","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"8.6","toFixed":"8.12","daysApart":144}]}},{"cve":"CVE-2024-9014","published":"2024-09-23","fixed":"8.12","kev":false},{"cve":"CVE-2025-2945","published":"2025-04-03","fixed":"9.2","kev":false},{"cve":"CVE-2025-2946","published":"2025-04-03","fixed":"9.2","kev":false},{"cve":"CVE-2025-9636","published":"2025-09-04","fixed":"9.8","kev":false}],"package":"PyPI:pgadmin4"}}