CVE-2026-14672

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

State: Published
Severity: 5.3 Medium
Published: Aug 13, 2026
Updated: Aug 29, 2026
Reserved: Jul 3, 2026

Description

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	PostgreSQL

Weaknesses

CWE-204 Observable Response Discrepancy

Affected Products

Product	Versions
PostgreSQLn/a	18 to before 18.6Affected 17 to before 17.11Affected 16 to before 16.15Affected

References

https://www.postgresql.org/support/security/CVE-2026-14672/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.