pgAdmin 4 did not invalidate any active user session when a password was changed, whether the user performed the change or an administrator reset it. As a result, any session established before the password change—such as those opened on another device or created with a compromised credential or session cookie—continues to remain authorized until it naturally expires. This flaw effectively allows an attacker who still possesses the old password or an existing session token to retain unauthorized access to the application, undermining the security intent of a password change. The weakness is a session‑fixation issue identified as CWE‑613.

The flaw exists in all deployments of pgAdmin 4 versions preceding 9.19 regardless of operating system. It applies to installations that use the default authentication flow and store session tokens in the standard database field. Any user with administrative privileges or access to the password reset functionality is potentially affected.

The CVSS score of 2.3 indicates a low severity impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed production exploitation. Based on the description, it is inferred that attackers would need knowledge of an existing session or the old password to leverage the flaw. The likely attack vector is the possession of a valid session cookie or credential that predates the password change, which could be obtained through credential theft or passive monitoring. Given the low severity and limited exploitation prerequisites, the risk is low to moderate and primarily concerns environments where password changes are a key security control.