Improper Authentication in Postgresql JDBC Driver - CVE-2025-49146

Vulnerability identifier: #VU112166

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2025-49146

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Postgresql JDBC Driver
Event Processing
DataPower Operations Dashboard
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Cognos Dashboards on Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Storage Scale
IBM Business Automation Manager Open Editions
Bitbucket Server
AMQ Broker
Bitbucket Data Center
Confluence Data Center
Bamboo Server
Oracle Enterprise Data Quality
IBM Sterling Connect:Direct Web Services
Confluence Server
Red Hat Camel for Spring Boot

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to when the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). A remote attacker can intercept connections that users believed were protected by channel binding requirements.

Install updates from vendor's website.

• https://github.com/pgjdbc/pgjdbc/commit/9217ed16cb2918ab1b6b9258ae97e6ede244d8a0
• https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-hq9p-pm7w-8p54