VYPR
Low severity3.5NVD Advisory· Published Jun 18, 2026

pgAdmin 4: pgAdmin 4: Open redirect vulnerability in multi-factor authentication can lead to phishing

CVE-2026-12049

Description

pgAdmin 4: pgAdmin 4: Open redirect vulnerability in multi-factor authentication can lead to phishing

Affected products

1

Patches

Vulnerability mechanics

Root cause

"The supplied patch does not fix a security vulnerability; it only resolves a LaTeX build error for Vietnamese Unicode characters in documentation."

Attack vector

The patch does not address any security vulnerability. The commit message describes a LaTeX PDF build failure caused by Vietnamese Unicode characters in a CVE reporter name. There is no open redirect, no multi-factor authentication change, and no phishing-related code in this diff. The CVE description's claim of an open redirect in MFA is unsupported by the supplied patch.

Affected code

The patch modifies `docs/en_US/conf.py` to add LaTeX preamble declarations for two Vietnamese Unicode characters. This is a documentation build fix, not a security fix — the commit message explicitly states it is handling Vietnamese diacritics in the PDF build that broke after adding the CVE reporter's name. No application-level code is changed.

What the fix does

The patch adds `\DeclareUnicodeCharacter` declarations for two Vietnamese precomposed code points (U+1EA1 and U+1EC1) in the LaTeX preamble of the Sphinx documentation configuration. This allows `pdflatex` to typeset the characters 'ạ' and 'ề' that appear in the CVE reporter's name. The change is purely cosmetic for the PDF documentation build and has no effect on the pgAdmin 4 web application, its authentication logic, or any security-relevant behavior.

Generated on Jun 19, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

News mentions

0

No linked articles in our index yet.