The vulnerability (CVE-2026-14672) arises from an observable response discrepancy in PostgreSQL's SCRAM authentication mechanism. When an unauthenticated user attempts authentication, the server's response includes a SCRAM iteration count. For nonexistent users, the server returns the default iteration count, whereas for existing users with a non-default scram_iterations setting, the iteration count differs. This difference allows an attacker to test for the existence of specific users. The issue affects PostgreSQL major versions 16, 17, and 18, specifically versions before 16.15, 17.11, and 18.5. Versions before 16 are not vulnerable.

An unauthenticated attacker can confirm the existence of user accounts on affected PostgreSQL servers by observing the SCRAM iteration count in authentication responses. This information disclosure does not directly impact confidentiality, integrity, or availability beyond revealing user existence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor PostgreSQL vendor advisories for updates and consider adjusting scram_iterations settings to default as a temporary measure if feasible.