Improper restriction of excessive authentication attempts (CWE‑307) in pgAdmin 4 enables an attacker to bypass the built‑in MAX_LOGIN_ATTEMPTS safeguard by exploiting the default Flask‑Security /login view. Because pgAdmin’s custom /authenticate/login endpoint applies the lockout but the automatically registered /login endpoint does not consult the User.locked flag, an account that has already been locked can still be accessed. An attacker who triggers a lockout via the protected endpoint can then replay valid credentials to /login, removing the lockout protection and permitting unlimited online password guessing against INTERNAL accounts.

The vulnerability affects pgAdmin 4 prior to version 9.15, specifically for users authenticated with the INTERNAL authentication source. Users leveraging LDAP, OAuth2, Kerberos, or Webserver authentication are not impacted because they lack a local password and are rejected before the lockout check. Only installations of pgAdmin 4 before 9.15 that expose the default Flask‑Security /login route are vulnerable.

The CVSS base score is 6.9, indicating moderate severity, and the EPSS score is not published. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, via the web interface, and requires network access to the pgAdmin server. An attacker can initiate a lockout via /authenticate/login and subsequently perform an unbounded online credential‑guessing walk on INTERNAL accounts through the unprotected /login endpoint. The absence of automatic rate limiting on this path can lead to rapid password enumeration.