This vulnerability in pgAdmin 4 arises from the MFA validate and register endpoints honoring the 'next' query/form parameter without verifying that the redirect target is internal to pgAdmin. An authenticated user clicking a crafted link with an external 'next' parameter can be redirected to an attacker-controlled site, increasing the risk of successful phishing attacks. The vulnerability is classified as CWE-601 (Open Redirect). The fix involves a same-origin check helper that restricts redirects to relative paths or absolute URLs matching the current host and scheme, rejecting unsafe URLs including those with non-http schemes or userinfo tricks. The vulnerability affects pgAdmin 4 versions from 6.0 up to but not including 9.16.

The vulnerability does not allow attackers to gain read or write access to pgAdmin or the victim's database. However, it enables attackers to redirect authenticated users to malicious external sites via the MFA flow, potentially increasing the effectiveness of phishing attacks by leveraging trusted pgAdmin URLs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a fix that introduces a same-origin redirect validation helper to restrict unsafe redirects. Until an official patch is confirmed, users should be cautious of phishing links exploiting this redirect behavior. No known exploits are reported in the wild at this time.