CVE-2026-14672

An observable response discrepancy in PostgreSQL's SCRAM authentication permits user enumeration. Unauthenticated attackers can verify if a specific user exists by observing the authentication iteration count, provided the targeted user is configured with a non-default scram_iterations value.

A moderate-severity vulnerability in PostgreSQL allows unauthenticated attackers to enumerate valid users. By observing discrepancies in SCRAM authentication responses, attackers can identify users configured with a non-default scram_iterations count, which may facilitate targeted brute-force attacks.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this information disclosure, ensure all PostgreSQL users are configured with the default scram_iterations count. This prevents the observable response discrepancy that allows an unauthenticated user to determine user existence. Additionally, restrict network access to the PostgreSQL service to only trusted clients and networks by configuring firewall rules to limit inbound connections to the PostgreSQL port (default 5432). If firewall rules are modified, a service reload or restart may be required for changes to take effect.