Vulnerability Description
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 14.0, < 14.24 |
Related Weaknesses (CWE)
References
- https://www.postgresql.org/support/security/CVE-2026-14672/Vendor Advisory
FAQ
What is CVE-2026-14672?
CVE-2026-14672 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed use...
How severe is CVE-2026-14672?
CVE-2026-14672 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-14672?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql.