{"id":"CVE-2026-107314","revision":"da84ee8a64fe4692a26cf92c32a07b91","records":[{"revision":"da84ee8a64fe4692a26cf92c32a07b91","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107314","aliases":[],"title":"pgjdbc does not enforce requireAuth when the value excludes every authentication method","description":"pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for, including cleartext password authentication. A value without a method in it, such as requireAuth=, (a single comma), is affected the same way. An attacker positioned between the application and its server can ask for cleartext password authentication and receive the database password. A positive list such as requireAuth=scram-sha-256, and a partial exclusion such as requireAuth=!password,!md5, are enforced correctly. The property has no default value, so a deployment that does not set it is not affected. 42.7.14 fixes the problem: such a connection is refused with SQLState 08004, and a value without a method in it is rejected as invalid.","state":0,"publishedAt":"2026-10-07T23:03:01.5+00:00","modifiedAt":"2026-10-08T14:47:31.949+00:00","affected":[{"ecosystem":"https://repo.maven.apache.org/maven2","name":"org.postgresql:postgresql","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"pgjdbc\",\n                    \"product\": \"pgjdbc\",\n                    \"collectionURL\": \"https://repo.maven.apache.org/maven2\",\n                    \"packageName\": \"org.postgresql:postgresql\",\n                    \"repo\": \"https://github.com/pgjdbc/pgjdbc\",\n                    \"programFiles\": [\n                        \"pgjdbc/src/main/java/org/postgresql/core/AuthMethod.java\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"org.postgresql.core.AuthMethod.parseRequireAuth\"\n                        },\n                        {\n                            \"name\": \"org.postgresql.core.AuthMethod.checkAuth\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"42.7.11\",\n                            \"lessThan\": \"42.7.14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"maven\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-rhp9-mr79-r74h"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107314","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107314","identifiers":["CVE-2026-107314"]},"retained":false,"historicalAffected":[]}],"coverage":[]}