CVE-2026-14672 is an authentication oracle vulnerability in PostgreSQL's SCRAM authentication. It allows unauthenticated attackers to test for the existence of a database user by observing the SCRAM iteration count in the authentication challenge response. The vulnerability requires the probed user to have a non-default scram_iterations setting, as nonexistent users receive a challenge with the default iteration count. This discrepancy in responses enables user enumeration. The issue affects PostgreSQL major versions 16, 17, and 18 before the minor versions 16.15, 17.11, and 18.5 respectively. Versions before 16 are unaffected. A patch is available to address this issue.

An unauthenticated attacker can confirm the existence of specific database users by exploiting differences in SCRAM iteration counts during authentication challenges. This user enumeration can aid in further targeted attacks or reconnaissance but does not directly allow authentication bypass or data access.

A patch is available for this vulnerability. Users should upgrade PostgreSQL to versions 16.15 or later, 17.11 or later, and 18.5 or later to remediate this issue. No additional mitigation is required if these updates are applied.