BIT-pgbouncer-2025-2291

vendorUSosv

PgBouncer default auth_query does not take Postgres password expiry into account

view advisory published 2025-04-18Licence: per source

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-2291US	critical9.8	0.37% (31st)	—	2025-04-16
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired p…

references

External citations — patches, advisories, analysis.

https://lists.debian.org/debian-lts-announce/2025/05/msg00032.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-2291WEB
https://www.pgbouncer.org/changelog.html#pgbouncer-124xARTICLE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan