PgBouncer versions prior to 1.25.2 allowed anyone with administrative console access to issue the KILL_CLIENT command without verifying that the user was listed in the admin_users parameter. This flaw permitted an authenticated administrator to terminate arbitrary client connections, potentially disrupting legitimate users and causing service outages. The weakness is classified as CWE‑862: Authorization Bypass Through User-Controlled Key.

The vulnerability affects the PgBouncer database connection pooling application. All installations running a version earlier than 1.25.2 are vulnerable, regardless of platform or deployment environment.

The CVSS score of 4.3 indicates a moderate severity. Because the exploit requires privileged access to the administration console, it is not an unauthenticated remote attack but can still result in significant availability impact for the affected database cluster. EPSS data is not available and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting current exploitation is unlikely but the vulnerability remains exploitable by anyone with admin rights.