8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49146

CVE-2025-49146: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Impact

When the PostgreSQL JDBC driver is configured with channel binding set to required (default value is prefer), the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding (such as password, MD5, GSS, or SSPI authentication). This could allow a man-in-the-middle attacker to intercept connections that users believed were protected by channel binding requirements.

Patches

TBD

Workarounds

Configure sslMode=verify-full to prevent MITM attacks.

References

https://www.postgresql.org/docs/current/sasl-authentication.html#SASL-SCRAM-SHA-256
https://datatracker.ietf.org/doc/html/rfc7677
https://datatracker.ietf.org/doc/html/rfc5802

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49146

CVE-2025-49146:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.postgresql:postgresql	maven	>= 42.7.4, < 42.7.7	42.7.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-49146, arises from the pgjdbc driver incorrectly allowing fallback to insecure authentication methods when channelBinding=require is configured. The channelBinding feature is intended to prevent man-in-the-middle attacks by cryptographically linking the TLS channel to the authentication mechanism.

The provided patch (commit 9217ed16) modifies the org.postgresql.core.v3.ConnectionFactoryImpl.doAuthentication method. Before this patch, this method did not enforce the channelBinding=require setting for non-SASL authentication methods. If a user configured channelBinding=require but the server proposed an authentication method like MD5 or password (which do not support channel binding), the driver would proceed with the insecure authentication, failing to honor the require directive.

The patch introduces new logic within doAuthentication to check the ChannelBindingOption. If it's set to REQUIRE, the code now verifies that the authentication request (areq) is for SASL (AUTH_REQ_SASL, AUTH_REQ_SASL_CONTINUE, AUTH_REQ_SASL_FINAL). If it's not a SASL method, or if it's AUTH_REQ_OK (server skips authentication) without a completed SASL handshake, a PSQLException is thrown, rejecting the connection. This ensures that when channel binding is required, only authentication methods that support it (specifically SCRAM via SASL in this context) are permitted.

Therefore, the doAuthentication function, in its pre-patch state, is the vulnerable function because it failed to correctly implement the channelBinding=require security control, allowing connections with authentication methods that do not support channel binding.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49146: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Impact

Patches

Workarounds

References

CVE-2025-49146:

8.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-49146: pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Impact

Patches

Workarounds

References

Technical Details

8.2

8.2

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI