The vulnerability allows an attacker to bypass the built‑in login‑attempt counter in pgAdmin 4, enabling unlimited password guesses against any internal account, including the administrator account, in the default configuration. Because Flask‑Security’s own login, password verification, change, and reset endpoints bypass pgAdmin’s lockout logic, repeated failed attempts do not trigger account locking, and password resets can be applied to accounts from different authentication sources. This issue maps to CWE‑307 (Improper Limitation of Login Attempts) and CWE‑863 (Improper Authentication via Security Surface), and carries a CVSS score of 9.2, indicating a high severity impact on confidentiality and integrity.

All installations of pgAdmin 4 running a version earlier than 9.19 are affected, regardless of whether LDAP, Kerberos, or web server authentication is enabled. The vulnerability does not impact the desktop mode of the application.

The flaw is exploitable through the web interface by sending HTTP requests to Flask‑Security endpoints such as /login, /verify, /change, and /reset. Because the server does not enforce login‑attempt limits, an unauthenticated attacker can iterate over valid usernames and passwords without triggering a lockout. The EPSS score is unavailable, but the high CVSS and lack of a KEV listing suggest that exploitation is plausible in environments where attackers have network access to the pgAdmin service. The vulnerability’s exploitation requires only standard web‑interface access and does not rely on privileged local access.