The PostgreSQL JDBC driver silently accepts authentication methods it should reject when the requireAuth property excludes every known method or is empty. As a result, an attacker between the application and the server can force the driver to accept cleartext password authentication and retrieve the database password, producing a cleartext credential disclosure that undermines database confidentiality.

The vulnerability affects the PostgreSQL JDBC Driver (pgjdbc) versions 42.7.11 through 42.7.13 when the connection property requireAuth is set to exclude all authentication methods or to an empty value. No other pgjdbc versions or products are affected. The driver has no default value for requireAuth, so systems that do not set the property are not impacted.

The CVSS base score is 5.9, reflecting a moderate severity. The EPSS score is 0.00256 (0.256%) and the issue is not listed in CISA’s KEV catalogue, suggesting no publicly confirmed exploitation. However, the attack requires an attacker to position themselves between the application and database server and to initiate a cleartext password authentication request. Once the driver is tricked, it will transmit the password in cleartext to the attacker, granting credential theft. Although exploitation conditions are relatively specific, the potential impact on confidentiality is significant.