pgAdmin is affected by an LDAP injection vulnerability

HIGH 7.5CVE-2025-12764 · GHSA-cvf4-f829-762v · PYSEC-2026-1772 · Published 13/11/2025 · updated 07/10/2026

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 9.10`	`9.10`
pgadmin 4 pgadmin	`< 9.10`	`9.10`

Description

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amount of data DOS.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-12764 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit 09d2b7e · WEB
pgadmin-org/pgadmin4 · PACKAGE
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-cvf4-f829-762v · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free