CVE-2025-2291CWE-324

PgBouncer default auth_query does not take Postgres password expiry into account

High · published April 16, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Weakness
CWE-324 · Use of a Key Past its Expiration Date
Published
2025-04-16T18:00Z
EPSS history
Timeline
  • 16 APR 18:00Z
    PgBouncer default auth_query does not take Postgres password expiry into account
    cvelistv5