The flaw is a discrepancy in the number of SCRAM authentication iterations reported to an unauthenticated client. When a user has a non‑default scram_iterations value, the server uses that number for a real account but returns the default count for a nonexistent account. An attacker can observe the response and determine whether a specific username exists, giving a purely informational oracle without credential theft or privilege escalation. The weakness is an authorization error (CWE‑204).

The vulnerability affects PostgreSQL 16.0 through 16.14, PostgreSQL 17.0 through 17.10, and PostgreSQL 18.0 through 18.4. All releases prior to PostgreSQL 16 are not affected. The flaw only applies when users have a custom scram_iterations configuration; systems that keep the default setting are not impacted.

The CVSS base score is 5.3, indicating a moderate risk. Exploitation requires only passive observation of the authentication handshake, so an attacker can test for usernames from any network access point without credentials. The EPSS score is not available, making it unclear how often this vulnerability is targeted in the wild. It is not listed in the CISA KEV catalog. The typical attack path involves a simple network probe that initiates a SCRAM authentication sequence with a candidate username and records the iteration count in the challenge; a mismatch with the default indicates the account exists.