The vulnerability arises from an observable discrepancy in the number of SCRAM authentication iterations returned by PostgreSQL. When a user account has a non‑default scram_iterations setting, the server uses that custom value for authenticating an existing username but returns the default iteration count for a nonexistent username. An unauthenticated attacker can therefore initiate a SCRAM authentication attempt, observe the iteration count in the challenge response, and determine whether a particular account exists in the database. This knowledge is purely informational; it does not grant credentials or elevate privileges, but it can facilitate credential-guessing or targeted social engineering. The weakness is related to authorization error, as represented by CWE‑204.

The vulnerability affects PostgreSQL 16.0 through 16.14, PostgreSQL 17.0 through 17.10, and PostgreSQL 18.0 through 18.4. All releases prior to PostgreSQL 16 are not affected. The flaw only applies when users have a custom scram_iterations configuration; systems that keep the default setting are not impacted.

The CVSS base score is 5.3, indicating a moderate risk. Exploitation requires only passive observation of the authentication handshake, so an attacker can test for usernames from any network access point without credentials. The EPSS score of 0.00252 (<1%) suggests a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The typical attack path involves a simple network probe that initiates a SCRAM authentication sequence with a candidate username and records the iteration count in the challenge; a mismatch with the default indicates the account exists.