pgAdmin 4 in server mode before version 9.19 has a vulnerability that allows bypassing the lockout mechanism after multiple failed login attempts on internal accounts. This flaw permits an unauthenticated attacker to make unlimited password guesses against internal accounts, including administrators, due to improper handling of login attempts across different authentication views and case-insensitive username matching. Additional issues include improper password reset handling across accounts from different authentication sources and exposure of server configuration information to unauthorized users. The vulnerability does not affect desktop mode.