Threats tagged 'ghsa-wrw6-r8xj-f49j'

pgAdmin 4 versions prior to 9.19 did not invalidate existing user sessions when a password was changed, either by the user or an administrator. This allowed sessions established before the password change to remain active until they expired, potentially allowing continued access by unauthorized parties. The issue was fixed by rotating the user's session identifier upon password change, logging out all other sessions and re-encrypting saved server passwords under the new key.