Summary
A user-account selection flaw in pgAdmin 4 server mode can associate an LDAP or Kerberos login with a different account that has the same username or email. An attacker with valid credentials in a configured LDAP directory or Kerberos realm may therefore obtain another account's role, server connections, and saved database credentials.
A user-account selection flaw in pgAdmin 4 server mode can associate an LDAP or Kerberos login with a different account that has the same username or email. An attacker with valid credentials in a configured LDAP directory or Kerberos realm may therefore obtain another account's role, server connections, and saved database credentials.
Affected context
The issue occurs in pgAdmin 4 server mode when multiple authentication sources are enabled and separate accounts can share usernames or matching identity attributes. The risk is greatest when LDAP or Kerberos authentication is configured alongside internal authentication, because the authenticated identity was not consistently matched to the account belonging to the source that performed authentication. Desktop mode is not affected.
The issue occurs in pgAdmin 4 server mode when multiple authentication sources are enabled and separate accounts can share usernames or matching identity attributes. The risk is greatest when LDAP or Kerberos authentication is configured alongside internal authentication, because the authenticated identity was not consistently matched to the account belonging to the source that performed authentication. Desktop mode is not affected.
Exploit preconditions
- Attack surface: pgAdmin 4 server-mode login handling
- Required access: Valid credentials for an LDAP directory or Kerberos realm configured for pgAdmin
- Trigger point: Authentication and account selection after successful external authentication
- Identity condition: A matching username, email, or principal must identify another pgAdmin account
- Why exploitation is possible: Account lookup may rely on username or a prior login-form lookup without verifying the authenticating source
- Attack surface: pgAdmin 4 server-mode login handling
- Required access: Valid credentials for an LDAP directory or Kerberos realm configured for pgAdmin
- Trigger point: Authentication and account selection after successful external authentication
- Identity condition: A matching username, email, or principal must identify another pgAdmin account
- Why exploitation is possible: Account lookup may rely on username or a prior login-form lookup without verifying the authenticating source
Why this happens
The underlying bug is an authentication identity-binding failure. After successful LDAP or Kerberos authentication, pgAdmin selected an account by username alone or reused an account selected during an earlier internal login form lookup, rather than binding the session to both the authenticated identity and its authentication source. This maps primarily to CWE-287, Improper Authentication, and is related to CWE-639, Authorization Bypass Through User-Controlled Key, because an identity attribute influenced which account received the session.
The underlying bug is an authentication identity-binding failure. After successful LDAP or Kerberos authentication, pgAdmin selected an account by username alone or reused an account selected during an earlier internal login form lookup, rather than binding the session to both the authenticated identity and its authentication source. This maps primarily to CWE-287, Improper Authentication, and is related to CWE-639, Authorization Bypass Through User-Controlled Key, because an identity attribute influenced which account received the session.
Potential impact
- An attacker could be logged into another user's pgAdmin account
- A matching external identity could receive administrator-level privileges
- The attacker may access another account's registered servers
- Saved database passwords and connection metadata could be exposed
- Database systems managed through the misidentified account could be modified
- Administrative access could enable broader compromise of connected environments
- An attacker could be logged into another user's pgAdmin account
- A matching external identity could receive administrator-level privileges
- The attacker may access another account's registered servers
- Saved database passwords and connection metadata could be exposed
- Database systems managed through the misidentified account could be modified
- Administrative access could enable broader compromise of connected environments
General mitigation guidance
Mitigation generally centers on strict identity binding and source-aware
account selection.
- Associate each authenticated session with the verified identity and the
authentication source that validated it.
- Avoid selecting accounts solely by username, email, or other ambiguous
identifiers when multiple identity providers are enabled.
- Do not reuse account objects obtained from a login form unless their source
and authentication result are independently verified.
- Apply source-specific account restrictions and fail closed when identity
mappings are ambiguous.
- Minimize account privileges and limit access to stored connection
credentials.
- Use secure-by-default authentication ordering and configuration policies
that prevent unintended cross-source account matching.
Mitigation generally centers on strict identity binding and source-aware
account selection.
- Associate each authenticated session with the verified identity and the
authentication source that validated it.
- Avoid selecting accounts solely by username, email, or other ambiguous
identifiers when multiple identity providers are enabled.
- Do not reuse account objects obtained from a login form unless their source
and authentication result are independently verified.
- Apply source-specific account restrictions and fail closed when identity
mappings are ambiguous.
- Minimize account privileges and limit access to stored connection
credentials.
- Use secure-by-default authentication ordering and configuration policies
that prevent unintended cross-source account matching.
How teams detect issues like this
- Review authentication handlers for account lookups based only on usernames,
email addresses, or principals.
- Use static analysis and code review to identify session creation that is
not explicitly bound to the authenticated provider.
- Test duplicate or overlapping identities across internal, LDAP, and
Kerberos sources.
- Monitor authentication logs for an external source producing sessions for
accounts assigned to a different source.
- Add policy checks requiring authentication-source validation before account
selection and session creation.
- Automated security review tools may help identify ambiguous identity
mappings and missing authorization checks.
- Review authentication handlers for account lookups based only on usernames,
email addresses, or principals.
- Use static analysis and code review to identify session creation that is
not explicitly bound to the authenticated provider.
- Test duplicate or overlapping identities across internal, LDAP, and
Kerberos sources.
- Monitor authentication logs for an external source producing sessions for
accounts assigned to a different source.
- Add policy checks requiring authentication-source validation before account
selection and session creation.
- Automated security review tools may help identify ambiguous identity
mappings and missing authorization checks.
