pgAdmin 4 Account Lockout Bypass Vulnerability in Flask-Security Login View

A vulnerability in pgAdmin 4 prior to version 9.15 allows for an account lockout bypass through improper handling of authentication attempts. The application enforces a maximum login attempt policy only in its custom login view, while the default Flask-Security login view, accessible on all servers, fails to consider the locked status of user accounts. This oversight enables an attacker to exploit the authentication process by bypassing brute-force protections, particularly for accounts using the INTERNAL authentication source.

Impact

Exploitation of this vulnerability allows for an unbounded online password-guessing attack against INTERNAL accounts, bypassing the application's login attempt rate limits and MAX_LOGIN_ATTEMPTS policy.

Remediation

This vulnerability has been fixed in pgAdmin 4 version 9.15. Users should upgrade to this version to address the issue.