https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 31 Oct 2026 20:27:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116238 <p>In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator&#39;s, in the default configuration:</p> <p>- Flask-Security registers its own views next to pgAdmin&#39;s. A login submitted to its /login view was checked and logged in without pgAdmin&#39;s failed login count or lock. Its /verify view checked a signed-in user&#39;s password without limit, its /change view changed a password without pgAdmin&#39;s change password permission or re-encrypting the user&#39;s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.</p> <p>In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator&#39;s account.</p> <p>The fix refuses s…</p> <p>In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator&#39;s, in the default configuration:</p> <p>- Flask-Security registers its own views next to pgAdmin&#39;s. A login submitted to its /login view was checked and logged in without pgAdmin&#39;s failed login count or lock. Its /verify view checked a signed-in user&#39;s password without limit, its /change view changed a password without pgAdmin&#39;s change password permission or re-encrypting the user&#39;s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.</p> <p>In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator&#39;s account.</p> <p>The fix refuses s…</p> https://db.gcve.eu/vuln/fkie_cve-2026-116238 https://db.gcve.eu/vuln/ghsa-jq9v-4fgp-83ww <p>In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator&#39;s, in the default configuration:</p> <p>- Flask-Security registers its own views next to pgAdmin&#39;s. A login submitted to its /login view was checked and logged in without pgAdmin&#39;s failed login count or lock. Its /verify view checked a signed-in user&#39;s password without limit, its /change view changed a password without pgAdmin&#39;s change password permission or re-encrypting the user&#39;s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.</p> <p>In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator&#39;s account.</p> <p>The fix refuses s…</p> <p>In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator&#39;s, in the default configuration:</p> <p>- Flask-Security registers its own views next to pgAdmin&#39;s. A login submitted to its /login view was checked and logged in without pgAdmin&#39;s failed login count or lock. Its /verify view checked a signed-in user&#39;s password without limit, its /change view changed a password without pgAdmin&#39;s change password permission or re-encrypting the user&#39;s saved server passwords, and its /reset views sent and applied password resets for accounts that are not internal or are locked. - The internal account was looked up by its exact username, while the login form matches the email ignoring case, so a login with the username typed in another case was neither counted nor checked for the lock. - With LDAP or webserver authentication also configured, a wrong internal password was never counted, and with Kerberos or webserver authentication configured a guess could be answered without being counted.</p> <p>In addition, where accounts from different authentication sources share an email address, a password reset could be sent for, or applied to, an account from another source, and the About box showed the server configuration to a user whose email was that of an administrator&#39;s account.</p> <p>The fix refuses s…</p> https://db.gcve.eu/vuln/ghsa-jq9v-4fgp-83ww