Search: CVE-2026-53712

A vulnerability in com.ongres.scram:scram-client versions prior to 3.3 allows a TLS man-in-the-middle attacker to silently downgrade SCRAM authentication from SCRAM-SHA-256-PLUS (with channel binding) to SCRAM-SHA-256 (without channel binding). This occurs when the server presents an X.509 certificate using modern signature algorithms that the client cannot parse properly, causing fallback to a less secure authentication method without error. This can bypass strict channel binding policies in affected deployments.