{"id":"CVE-2025-9636","published":"2025-09-04T16:43:27Z","modified":"2026-02-26T17:49:38Z","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"tail","description":{"text":"pgAdmin <= 9.7 is affected by a  Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.9,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00227,"percentile":0.1338,"provenance":"source"},"cwes":[{"id":"CWE-346","name":"Origin Validation Error"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/9114","tags":["issue-tracking"]}],"priority":{"score":8.2,"factors":[{"name":"EPSS percentile","points":2.68},{"name":"CVSS severity","points":5.53}]},"vendorSlug":"pgadmin-org","affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 9.8"]}],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<9.8"],"patched":["9.8"],"from":["GHSA-6859-2qxq-ffv2","PYSEC-2026-1769"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-26729","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2024-9014","published":"2024-09-23","fixed":"8.12","kev":false},{"cve":"CVE-2025-2945","published":"2025-04-03","fixed":"9.2","kev":false},{"cve":"CVE-2025-2946","published":"2025-04-03","fixed":"9.2","kev":false,"link":{"from":"CVE-2025-2946","to":"CVE-2025-9636","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:pgadmin4","fromFixed":"9.2","toFixed":"9.8","daysApart":154}]}},{"cve":"CVE-2025-9636","published":"2025-09-04","fixed":"9.8","kev":false},{"cve":"CVE-2025-12762","published":"2025-11-13","fixed":"9.10","kev":false},{"cve":"CVE-2025-12763","published":"2025-11-13","fixed":"9.10","kev":false},{"cve":"CVE-2025-12764","published":"2025-11-13","fixed":"9.10","kev":false}],"package":"PyPI:pgadmin4"}}