pgAdmin 4 contains an open redirect vulnerability in its multi‑factor authentication flow because the 'next' parameter is accepted without validation. An attacker can supply an external URL in /mfa/validate?next=... and an authenticated victim will be redirected to the attacker’s host after succeeding the MFA step. This does not grant direct access to pgAdmin or the victim's database, but it can bypass the typical phishing trust barrier and increase the success rate of subsequent credential‑phishing attacks. The weakness is classified as CWE‑601.

Versions of pgAdmin 4 from 6.0 up to and including 9.15 are affected. The vulnerability exists in the MFA validate and register endpoints and is present in all pgAdmin 4 releases prior to 9.16.

The CVSS score of 5.3 indicates a moderate severity, mainly due to the impact on user trust rather than direct privilege escalation. The EPSS score is not available, so the current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a phishing link delivered to an authenticated user; the attacker must have an active account and the user must deliberately click the redirect. Without the need for elevated privileges, the exploitation risk is limited to credential compromise, thereby making mitigation through an upgrade the preferred course of action.