#VU107593 Weak password requirements in pgbouncer - CVE-2025-2291

Vulnerability identifier: #VU107593

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-2291

CWE-ID: CWE-521

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
pgbouncer
Other software / Other software solutions

Vendor: wiki.postgresql.org

Description

The vulnerability allows an attacker to gain unauthorized access to the application.

The vulnerability exists due to password can be used past its expiration as auth_query is not taking into account Postgre's VALID UNTIL value. An attacker with knowledge of an expired password can successfully login to the application.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

pgbouncer: 1.0 - 1.24.0

---

External links
https://www.pgbouncer.org/changelog.html#pgbouncer-124x

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.