← CVE Intelligence

CVE-2025-2291

PgBouncer default auth_query does not take Postgres password expiry into account PUBLISHED

Description (CNA)

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

Affected (CNA)

Vendor / productVersions
n/a / PgBounceraffected 0 before 1.24.1

CWE

CWE-324

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.