CVE-2026-107350— Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Quick assessment
Affected
n/a PgBouncer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PgBouncer 1.17.0 至 1.26.0 版本中存在身份验证处理不当的漏洞，允许远程攻击者利用其在 auth_file 中已知密码的用户身份，冒充任何其他使用 SCRAM 机制进行认证的用户进行登录，包括 PgBouncer 管理员用户和后端超级用户。当攻击者在 SCRAM 认证过程中，向不存在的数据库发送第二个 StartupMessage 时，该消息未被拒绝，从而导致当前登录用户的身份发生切换，而 SCRAM 认证过程仍仅基于第一个用户的密钥进行验证。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer
Source: CVE Program / CVE List V5
Vulnerability Description
Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superusers. A second StartupMessage sent during SCRAM authentication against a non-existent database is not rejected and switches the user being logged in as, while the SCRAM exchange is still verified against the keys of the first user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PgBouncer | 1.17.0 ~ 1.26.1 | - |
|
II. Public POCs for CVE-2026-107350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107350
请登录查看更多情报信息。
Same Patch Batch · n/a · 2026-10-14 · 5 CVEs total
| CVE-2026-107349 | 7.5 HIGH | Infinite loop on empty option name in startup options parameter in PgBouncer |
| CVE-2026-110679 | 7.3 HIGH | OpenSIPS rtpproxy rtpproxy_answer out-of-bounds |
| CVE-2026-110698 | 6.3 MEDIUM | Praat Model Loader whisper.cpp whisper_model_load out-of-bounds write |
| CVE-2026-107348 | 5.9 MEDIUM | Integer overflow causes an infinite loop in message buffer growth in PgBouncer |
IV. Related Vulnerabilities
Same product: PgBouncer
-
CVE-2026-107349
Infinite loop on empty option name in startup options parame -
CVE-2026-107348
Integer overflow causes an infinite loop in message buffer g -
CVE-2026-6669
Unbounded SCRAM iteration count causes CPU exhaustion in PgB -
CVE-2026-19888
NULL pointer dereference in SCRAM client-final-message parsi -
CVE-2026-6668
Integer overflow causes an infinite loop in packet buffer gr
Same weakness: CWE-287
-
CVE-2026-45451
Unitronics - CWE-287: Improper Authentication -
CVE-2026-110864
Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass -
CVE-2026-110863
Better Auth @better-auth/sso before 1.7.3 Authentication Byp -
CVE-2026-110862
Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass -
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an exis
V. Comments for CVE-2026-107350
No comments yet