CVE-2025-2291: PgBouncer Auth Bypass Vulnerability

CVE-2025-2291 Overview

A critical authentication bypass vulnerability exists in PgBouncer, a lightweight connection pooler for PostgreSQL. The vulnerability stems from the auth_query mechanism failing to account for PostgreSQL's VALID UNTIL password expiration value. This flaw allows an attacker to authenticate using credentials that have already expired according to PostgreSQL's password policy, effectively bypassing the intended password expiration security controls.

Critical Impact

Attackers can log in with expired passwords, completely bypassing password expiration policies and potentially gaining unauthorized access to protected PostgreSQL databases through PgBouncer connection pooling.

Affected Products

• PgBouncer (all versions prior to the patch)
• Debian Linux 11.0

Discovery Timeline

• 2025-04-16 - CVE-2025-2291 published to NVD
• 2025-12-08 - Last updated in NVD database

Technical Details for CVE-2025-2291

Vulnerability Analysis

This vulnerability is classified under CWE-324 (Use of a Key Past its Expiration Date). The core issue lies in how PgBouncer handles authentication when configured to use auth_query for credential validation. PostgreSQL provides a VALID UNTIL timestamp field for role passwords that defines when a password should expire and no longer be accepted for authentication. However, PgBouncer's auth_query implementation retrieves and validates the password hash without checking this expiration timestamp.

When PgBouncer performs authentication via auth_query, it queries the PostgreSQL pg_shadow or pg_authid catalog tables to retrieve the password hash for comparison. The vulnerability occurs because the query retrieves the password hash but ignores the valuntil (VALID UNTIL) column that contains the password expiration date. This allows connections to succeed with credentials that PostgreSQL itself would reject if the client connected directly to the database.

Root Cause

The root cause is an incomplete implementation of PostgreSQL's authentication semantics within PgBouncer's auth_query feature. When PgBouncer validates credentials, it performs a password hash comparison but fails to evaluate the temporal validity of the password. PostgreSQL's VALID UNTIL feature is designed as a security control to enforce password rotation policies and limit the exposure window of compromised credentials. By not respecting this field, PgBouncer creates an authentication bypass where expired credentials remain functional indefinitely when connecting through the connection pooler.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who possesses valid but expired database credentials can successfully authenticate to PgBouncer and gain access to the backend PostgreSQL database. This is particularly concerning in scenarios where:

1. Password rotation policies are enforced through VALID UNTIL dates
2. Users or service accounts have had their passwords expired as part of credential revocation
3. Credentials were leaked or compromised and subsequently expired as a mitigation measure

The attacker simply needs to attempt authentication through PgBouncer using the expired credentials. Since PgBouncer does not verify the expiration timestamp, the authentication succeeds even though the same credentials would be rejected by a direct PostgreSQL connection.

Detection Methods for CVE-2025-2291

Indicators of Compromise

• Successful authentication events in PgBouncer logs from accounts that have expired VALID UNTIL timestamps in PostgreSQL
• Discrepancy between PgBouncer connection logs and PostgreSQL authentication logs for the same credentials
• Database connections originating from PgBouncer for users whose passwords should have expired
• Unusual access patterns from accounts that were believed to be decommissioned

Detection Strategies

• Compare PgBouncer authentication successes against PostgreSQL pg_authid table to identify connections using expired credentials
• Implement custom logging to track authentication attempts and cross-reference with VALID UNTIL timestamps
• Monitor for authentication from accounts with valuntil dates in the past
• Set up alerts for any successful PgBouncer connections from accounts in a known-expired state

Monitoring Recommendations

• Enable verbose logging in PgBouncer to capture all authentication events
• Regularly audit PostgreSQL roles with VALID UNTIL settings against PgBouncer connection logs
• Implement a scheduled job to identify and alert on expired credentials that have recent PgBouncer authentication activity
• Consider logging directly to a SIEM for correlation of authentication events across PgBouncer and PostgreSQL

How to Mitigate CVE-2025-2291

Immediate Actions Required

• Upgrade PgBouncer to version 1.24.x or later which addresses this vulnerability
• Review all PostgreSQL roles with expired VALID UNTIL timestamps and reset their passwords
• Audit recent PgBouncer authentication logs for any access using credentials that should have been expired
• Consider temporarily switching from auth_query to auth_file or auth_hba_file authentication methods until patched

Patch Information

The vulnerability has been addressed in PgBouncer version 1.24.x. According to the PgBouncer Change Log, this release includes fixes for the authentication bypass vulnerability. Debian Linux 11 users should refer to the Debian LTS Announcement for distribution-specific patching information.

Workarounds

• Implement application-level password expiration checks before connecting through PgBouncer
• Use auth_file authentication mode and manually update the file when credentials expire
• Deploy network segmentation to limit access to PgBouncer from untrusted sources
• Immediately change passwords for any accounts that rely on VALID UNTIL for expiration rather than waiting for expiry

# Query to identify PostgreSQL roles with expired passwords that may be affected
psql -c "SELECT rolname, rolvaliduntil FROM pg_roles WHERE rolvaliduntil IS NOT NULL AND rolvaliduntil < NOW();"