Threats tagged 'ghsa-5539-rjhp-jvgv'

A vulnerability in pgAdmin 4 before version 9.19 allowed unintended use of a Kerberos service account's credentials for GSSAPI authentication. When a connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed the KRB5CCNAME environment variable, causing the Kerberos library to fall back to the default credential cache of the operating system account running pgAdmin. This allowed any user to connect as the service account's Kerberos principal regardless of the username provided. The issue also affected Windows SSPI and psql started with pgAdmin's environment. The fix involves isolating Kerberos credential environment variables per connection and requiring updated libpq 16 or later for proper authentication enforcement.