# PgBouncer 1.26.1 fixes authentication bypass and two denial-of-service flaws

_Published Wednesday, October 14, 2026 at 7:06 AM EDT · Security, Infrastructure · Latest · Tier 2 — Notable_

PgBouncer has released version 1.26.1 to fix three security vulnerabilities, including an authentication bypass that lets a client knowing one SCRAM user's password log in as another SCRAM user, including administrators and backend superusers. The bypass involves processing a second startup message during authentication when connecting to a nonexistent database.

The release also fixes two infinite loops that unauthenticated clients can trigger. One involves an empty startup option name under specific settings for ignoring startup parameters. The other stems from an integer overflow as the packet buffer grows and applies only when max_packet_size exceeds its default.

## Sources

- [PostgreSQL news](https://www.postgresql.org/about/news/pgbouncer-1261-released-fixes-three-cves-3403/)

---
Canonical: https://techandbusiness.org/newswire/ZL5A1AcmmF8DX5LyejK7l8
Published: 2026-10-14T11:06:48.507Z
Story chronology: 2026-10-14T00:00:00.000Z
Retrieved: 2026-10-14T13:54:53.427Z
Publisher: Tech & Business (techandbusiness.org)