Vulnerability Details CVE-2025-2291
Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 14.8%
CVSS Severity
CVSS v3 Score 8.1
References
Products affected by CVE-2025-2291
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.3
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.4
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.5
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.6
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.7
-
cpe:2.3:a:pgbouncer:pgbouncer:1.0.8
-
cpe:2.3:a:pgbouncer:pgbouncer:1.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.1.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.1.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.10.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.11.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.12.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.13.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.14.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.15.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.16.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.16.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.17.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.18.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.19.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.19.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.2.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.2.3
-
cpe:2.3:a:pgbouncer:pgbouncer:1.20.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.20.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.21.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.22.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.22.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.23.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.23.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.24.0
-
cpe:2.3:a:pgbouncer:pgbouncer:1.3
-
cpe:2.3:a:pgbouncer:pgbouncer:1.3.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.3.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.3.3
-
cpe:2.3:a:pgbouncer:pgbouncer:1.3.4
-
cpe:2.3:a:pgbouncer:pgbouncer:1.4
-
cpe:2.3:a:pgbouncer:pgbouncer:1.4.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.4.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5.3
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5.4
-
cpe:2.3:a:pgbouncer:pgbouncer:1.5.5
-
cpe:2.3:a:pgbouncer:pgbouncer:1.6
-
cpe:2.3:a:pgbouncer:pgbouncer:1.6.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.7
-
cpe:2.3:a:pgbouncer:pgbouncer:1.7.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.7.2
-
cpe:2.3:a:pgbouncer:pgbouncer:1.8
-
cpe:2.3:a:pgbouncer:pgbouncer:1.8.1
-
cpe:2.3:a:pgbouncer:pgbouncer:1.9.0
-
cpe:2.3:o:debian:debian_linux:11.0