PgBouncer 1.26.1 fixes authentication bypass and two denial-of-service flaws

PgBouncer has released version 1.26.1 to fix three security vulnerabilities, including an authentication bypass that lets a client knowing one SCRAM user's password log in as another SCRAM user, including administrators and backend superusers. The bypass involves processing a second startup message during authentication when connecting to a nonexistent database. The release also fixes two infinite loops that unauthenticated clients can trigger. One involves an empty startup option name under specific settings for ignoring startup parameters. The other stems from an integer overflow as the packet buffer grows and applies only when max_packet_size exceeds its default.