{"uuid": "ff7b9d72-2573-4734-8546-bb69ed96f115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-86863", "type": "seen", "source": "https://t.me/pphm_HackerNews/3209", "content": "\ud83d\udd34 Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials\n\nA critical vulnerability in pgAdmin 4 could allow unauthenticated remote attackers to impersonate arbitrary users, including existing administrator accounts, by supplying a malicious HTTP identity header.\n\nThis vulnerability, tracked as CVE-2026-86863, affects installations using pgAdmin\u2019s Webserver authentication mode and has a CVSS 3.1 score of 9.8 out of 10.\n\nThe issue impacts pgAdmin 4 versions 6.2 through 9.17 and has been addressed in pgAdmin 4 version 9.18.", "creation_timestamp": "2026-09-20T10:00:05.033963Z"}