CVE-2026-53712: SCRAM Auth Bypass Vulnerability

CVE-2026-53712 Overview

CVE-2026-53712 is a channel-binding downgrade vulnerability in the com.ongres.scram:scram-client and com.ongres.scram:scram-common libraries. The flaw affects Salted Challenge Response Authentication Mechanism (SCRAM) implementations that follow the Simple Authentication and Security Layer (SASL, RFC 4422) family. An attacker with a Transport Layer Security (TLS) man-in-the-middle position can silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to SCRAM-SHA-256 without channel binding. The vulnerability triggers when TlsServerEndpoint processes X.509 certificates signed with modern algorithms such as Ed25519. Versions prior to 3.3 are affected, and the issue is categorized under [CWE-636] (Not Failing Securely).

Critical Impact
Attackers positioned for TLS interception can strip channel binding from SCRAM authentication, defeating a protection specifically designed to detect MITM attacks against authenticated sessions.

Affected Products

com.ongres.scram:scram-client versions prior to 3.3
com.ongres.scram:scram-common versions prior to 3.3
Applications relying on SCRAM-SHA-256-PLUS channel binding with Ed25519 or other modern signature algorithm certificates

Discovery Timeline

2026-07-17 - CVE-2026-53712 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-53712

Vulnerability Analysis

SCRAM-SHA-256-PLUS binds authentication to the TLS channel by hashing certificate material into the client proof. This binding allows the server to detect an interposed TLS proxy that terminates and re-originates the connection. The ongres SCRAM client implements the tls-server-end-point channel binding type, which hashes the server certificate using an algorithm derived from the certificate's signature algorithm.

When the certificate is signed with Ed25519 or another algorithm that does not map to a supported message digest, the internal lookup throws NoSuchAlgorithmException. Instead of failing the handshake, getChannelBindingData() returns an empty byte array. The ScramClient builder then interprets the empty array as the absence of channel-binding data and proceeds using plain SCRAM-SHA-256.

An attacker who can intercept TLS traffic can present a certificate chain that triggers this path, causing the client to drop channel binding without notifying the user or server policy. The authentication then completes over an attacker-controlled channel.

Root Cause

The root cause is improper error handling in TlsServerEndpoint. The routine catches NoSuchAlgorithmException and returns an empty result rather than propagating a fatal error. Combined with the ScramClient builder's decision to treat empty channel-binding data as "none requested," this produces a silent security downgrade.

Attack Vector

Exploitation requires network positioning sufficient to perform a TLS man-in-the-middle attack against the client. The attacker presents a server certificate signed with a modern signature algorithm such as Ed25519 that the client's channel-binding code cannot digest. The client emits a SCRAM-SHA-256 authentication exchange without channel binding, which the attacker can relay or manipulate.

The vulnerability manifests in the getChannelBindingData() method and the ScramClient builder logic. Refer to the GitHub Security Advisory GHSA-p9jg-fcr6-3mhf for technical specifics.

Detection Methods for CVE-2026-53712

Indicators of Compromise

Client authentication exchanges negotiating SCRAM-SHA-256 when the server advertises SCRAM-SHA-256-PLUS and channel binding is expected by policy.
Unexpected TLS certificate chains presented to clients, particularly certificates using Ed25519 or Ed448 signatures in environments that previously used RSA or ECDSA with SHA-2.
Application logs from ongres SCRAM library versions below 3.3 showing NoSuchAlgorithmException events near authentication activity.

Detection Strategies

Inventory Java dependencies to identify com.ongres.scram:scram-client and com.ongres.scram:scram-common versions below 3.3 using build manifests and software composition analysis.
Enable SCRAM mechanism logging on servers such as PostgreSQL to record which mechanism each client negotiates, and alert when clients that should use -PLUS fall back.
Monitor for TLS certificate changes on internal service endpoints, correlating certificate rotation events with authentication mechanism changes.

Monitoring Recommendations

Capture and review authentication mechanism selection metrics from database and messaging servers that support SCRAM.
Alert on any application exception traces referencing TlsServerEndpoint or channel-binding failures.
Track outbound TLS handshakes from application hosts and flag certificate signature algorithms that deviate from the established baseline.

How to Mitigate CVE-2026-53712

Immediate Actions Required

Upgrade com.ongres.scram:scram-client and com.ongres.scram:scram-common to version 3.3 or later across all consuming applications.
Enforce server-side policy that rejects SCRAM mechanisms without channel binding for clients connecting over TLS where channel binding is expected.
Audit certificate issuance to identify services using Ed25519 or other signature algorithms that trigger the vulnerable code path.

Patch Information

The maintainers fixed the vulnerability in version 3.3 of the ongres SCRAM libraries. Download the release from GitHub Release v3.3 and update Maven or Gradle coordinates for both scram-client and scram-common. Rebuild and redeploy dependent applications, then verify that authentication continues to negotiate SCRAM-SHA-256-PLUS against servers that advertise it.

Workarounds

Temporarily reissue affected server certificates using signature algorithms the library can digest, such as RSA with SHA-256 or ECDSA with SHA-256, until patched clients are deployed.
Restrict SCRAM authentication to network paths protected by mutual TLS or an authenticated transport that does not depend on channel binding for MITM detection.
Configure servers to require channel binding and disable plain SCRAM-SHA-256 negotiation for TLS-terminated clients where feasible.

bash

# Maven dependency update to the fixed version
mvn versions:use-dep-version -Dincludes=com.ongres.scram:scram-client -DdepVersion=3.3 -DforceVersion=true
mvn versions:use-dep-version -Dincludes=com.ongres.scram:scram-common -DdepVersion=3.3 -DforceVersion=true