CVE-2025-2291
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
- Score
- CVSS 3.1 9.8 Critical
- Status
- Analyzed - f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
- Published
- 2025-04-16
- Last modified
- 2025-11-03
- Weaknesses
- CWE-324
Affected products
References
- https://www.pgbouncer.org/changelog.html#pgbouncer-124x
- https://lists.debian.org/debian-lts-announce/2025/05/msg00032.html
