CVE-2024-9014: OAuth2 client ID and secret exposed through the web browser

September 23, 2024 (updated October 1, 2024)

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data.

References

github.com/advisories/GHSA-jm9x-rx9x-wpqj
github.com/pgadmin-org/pgadmin4
github.com/pgadmin-org/pgadmin4/issues/7945
nvd.nist.gov/vuln/detail/CVE-2024-9014
www.pgadmin.org/docs/pgadmin4/8.12/release_notes_8_12.html

Code Behaviors & Features

Detect and mitigate CVE-2024-9014 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →