High severity8.1NVD Advisory· Published Apr 16, 2025· Updated Jun 17, 2026

CVE-2025-2291

Description

Password can be used past expiry in PgBouncer due to auth_query not taking into account Postgres its VALID UNTIL value, which allows an attacker to log in with an already expired password

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pgbouncer/Pgbouncerv53 versions
0+ 2 more
- (no CPE)range: 0
- cpe:2.3:a:pgbouncer:pgbouncer:*:*:*:*:*:*:*:*range: <1.24.1
- (no CPE)range: <1.24
Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
osv-coords
pkg:bitnami/pgbouncer
Range: < 1.24.1

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2025/05/msg00032.htmlnvdMailing ListThird Party Advisory
www.pgbouncer.org/changelog.htmlnvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000