CVE-2025-9636: pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
7.9
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pgadmin4 | pip | < 9.8 | 9.8 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a Cross-Origin Opener Policy (COOP) misconfiguration in pgAdmin4's OAuth flow. The provided commit cdeb18fcbb139a200b5a4779c82f9cd1aaaf3c89 directly addresses this by introducing the Cross-Origin-Opener-Policy header.
The analysis of the patch reveals two key changes:
web/config.py: A new configuration option,CROSS_ORIGIN_OPENER_POLICY, is added and set to"same-origin". This defines the policy to be applied.web/pgadmin/utils/security_headers.py: Theset_response_headersfunction is modified to read the new configuration setting and add theCross-Origin-Opener-Policyheader to the HTTP response.
The function pgadmin.utils.security_headers.set_response_headers is the central point where the security headers are applied to outgoing responses. The vulnerability existed because this function was not setting the COOP header. By adding this logic, the patch mitigates the vulnerability. Any HTTP response generated during the OAuth flow would pass through this function, and its absence of the COOP header is the root cause of the vulnerability. Therefore, set_response_headers is the most relevant function that would appear in a runtime profile related to this vulnerability.