CVE-2026-14672
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS probability
- 0.25%
- CWE
- CWE-204
- Published
- 2026-08-13
- Last modified
- 2026-08-29
Affected products
- n/a PostgreSQL
- n/a PostgreSQL
- n/a PostgreSQL
Weakness type
Related vulnerabilities
- CVE-2026-86758 — Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- CVE-2026-19205 — User Enumeration in GastroMenum's GastroMenum Web Panel
- CVE-2026-19080 — Username Enumeration in Menulux Software's Menulux Portal
- CVE-2026-78584 — Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
- CVE-2026-84307 — Filament: Password validity disclosure for accounts denied panel access on login page
- CVE-2026-81033 — Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy
- CVE-2026-75575 — Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method
- CVE-2026-27462 — Combodo iTop: User enumeration via password reset