-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pgadmin4 | pip | <= 8.5 | 8.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing MFA enforcement on protected endpoints. The patch replaces Flask's native @login_required with a custom @pga_login_required that adds MFA checks. The files modified in the commit diff show numerous routes previously using @login_required without MFA validation. The key vulnerable pattern was relying solely on Flask-Security's authentication without additional MFA verification, which the CVE description confirms could be bypassed despite MFA enrollment.