This vulnerability arises from PostgreSQL's SCRAM authentication mechanism where the iteration count in the authentication challenge differs between existing users with non-default scram_iterations and nonexistent users, who receive the default iteration count. An unauthenticated attacker can leverage this discrepancy to verify the existence of specific database users. The affected versions include PostgreSQL major versions 16, 17, and 18 prior to minor releases 16.15, 17.11, and 18.6 respectively. Versions before 16 are unaffected.

An unauthenticated attacker can confirm the existence of a database user account by observing the SCRAM iteration count in the authentication challenge response. This information disclosure could aid in further targeted attacks but does not directly allow authentication or data compromise. The CVSS score is 5.3 (medium severity), reflecting limited confidentiality impact without integrity or availability effects.

Patch your PostgreSQL installations to versions 16.15, 17.11, or 18.6 or later where this issue is fixed. Since this is an authentication mechanism discrepancy, upgrading to the fixed versions is the recommended remediation. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the version boundaries stated in the vulnerability description.