← Database

CVE-2025-2291

HIGH CVSS: 8.1 Published: 2025-04-16 Modified: 2026-06-17

Description

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

Affected Platforms

Debian Debian LinuxPgbouncer Pgbouncer

Weakness Type

CWE-324

References