high8.1
CVE-2025-2291
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with…
Impact
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pgbouncer | Pgbouncer | before 1.24.1 |
| Debian | Debian Linux | Version 11.0 |