pgAdmin 4 Webserver Authentication Bypass

pgAdmin 4's Webserver authentication source was vulnerable to bypass due to improper handling of HTTP headers. An attacker could authenticate as any user, including an administrator, without providing credentials.

Affected versions: pgAdmin 4 from 6.2 before 9.18. The vulnerability is mitigated when 'webserver' is not enabled in AUTHENTICATION_SOURCES.