🔴 Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

A critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header.

This vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin’s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.

The issue impacts pgAdmin 4 versions 6.2 through 9.17 and has been addressed in pgAdmin 4 version 9.18.