PostgreSQL pgAdmin up to 9.18 Session Management session fixiation

Summaryinfo

A vulnerability was found in PostgreSQL pgAdmin up to 9.18. It has been declared as critical. Affected by this issue is some unknown functionality of the component Session Management. Such manipulation leads to session fixiation. This vulnerability is documented as CVE-2026-116251. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in PostgreSQL pgAdmin up to 9.18 and classified as critical. Affected by this issue is some unknown processing of the component Session Management. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired. The fix rotates the user's session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing. This issue affects pgAdmin 4: before 9.19.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-116251 since 10/25/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 9.19 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Database Software

Vendor

• PostgreSQL

Name

• pgAdmin

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8
• 9.9
• 9.10
• 9.11
• 9.12
• 9.13
• 9.14
• 9.15
• 9.16
• 9.17
• 9.18

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion