PgBouncer versions prior to 1.25.2 contain an authorization flaw in the handling of the KILL_CLIENT admin command. The vulnerability allows any user with access to the administration console to execute this command, bypassing intended restrictions that should limit this capability to users specified in the admin_users parameter. This could lead to denial of service by terminating client connections.