The com.ongres.scram:scram-client library versions before 3.3 contain a vulnerability (CVE-2026-53712) where a TLS man-in-the-middle attacker can cause a silent downgrade of SCRAM authentication from SCRAM-SHA-256-PLUS, which includes channel binding, to SCRAM-SHA-256 without channel binding. This happens because the client fails to parse certain modern X.509 certificate signature algorithms correctly and falls back to non-channel-bound authentication without alerting the user. This undermines security controls that rely on strict channel binding enforcement.

This vulnerability allows an attacker positioned as a man-in-the-middle on the TLS channel to bypass channel binding protections by downgrading the authentication method silently. This reduces the security guarantees of the SCRAM authentication process, potentially allowing unauthorized access or session hijacking in environments that enforce strict channel binding policies.

No official patch or fix is currently documented. Users should upgrade to version 3.3 or later once available, as versions prior to 3.3 are affected. Until a fix is released, consider avoiding use of affected versions in environments requiring strict channel binding enforcement or monitor for updates from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.