CVE-2025-2291

Summary

CVE-2025-2291 is a vulnerability affecting PgBouncer, a PostgreSQL connection pooler. The issue lies in the 'auth_query' module, which fails to consider the 'VALID UNTIL' value set in PostgreSQL. Consequently, an expired password can still be used to gain unauthorized access, posing a significant security risk. Attackers can exploit this vulnerability to bypass authentication controls and potentially gain unauthorized access to sensitive data or systems. System administrators are advised to update their PgBouncer instances to a patched version to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.