Threats tagged 'ghsa-mv93-hq32-623f'

pgAdmin 4 in server mode has an authentication flaw where accounts are maintained per authentication source, allowing the same username to exist across different sources (e.g., internal, LDAP, Kerberos). The application incorrectly associates authenticated users with accounts based solely on username, without verifying the authentication source. This can lead to users being logged in as different accounts, including privileged internal accounts, if usernames overlap. The issue affects versions before 9.19 and requires valid LDAP or Kerberos credentials to exploit.