This vulnerability arises from PostgreSQL's SCRAM authentication mechanism where the iteration count in the authentication challenge differs between existing users with non-default scram_iterations and nonexistent users, who receive the default iteration count. An unauthenticated attacker can exploit this discrepancy to confirm the presence of specific user accounts. The affected versions include major releases 16, 17, and 18, specifically versions before 16.15, 17.11, and 18.5. Versions prior to 16 are not affected. There is no vendor advisory or patch information provided, and the remediation level is not specified.

An unauthenticated attacker can determine whether a specific user exists in the PostgreSQL database by observing the SCRAM iteration count in the authentication response. This information disclosure could aid in further targeted attacks but does not directly allow authentication bypass or data modification. The confidentiality impact is limited to user existence information; integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or advisory, users should monitor PostgreSQL vendor communications for updates. No specific mitigations or workarounds are provided in the available data.