Executive brief
A security flaw in the Ongres SCRAM Java library allows an attacker to bypass mandatory security protections during the login process. By intercepting network traffic, an attacker can trick the system into using a less secure authentication method that lacks 'channel binding,' which is designed to prevent connection hijacking. This could allow an attacker to impersonate a user or intercept sensitive data even when the application is configured to require high-security connections.
Technical details
An algorithm downgrade vulnerability exists in Ongres SCRAM Java (scram-client and scram-common) prior to version 3.3. The flaw occurs in the TlsServerEndpoint component when processing X.509 certificates with modern signature algorithms (like Ed25519) that do not follow traditional naming conventions. The internal hash derivation fails, swallows a NoSuchAlgorithmException, and returns an empty byte array. The ScramClient builder incorrectly interprets this empty array as an absence of channel binding support rather than a failure, allowing a network-positioned MITM attacker to force a downgrade to non-channel-bound SCRAM-SHA-256. This bypasses strict client-side enforcement policies (e.g., channelBinding=require). The issue is resolved in version 3.3 by propagating exceptions correctly and introducing explicit policy controls.
Affected products
- Ongres scram-client < 3.3
- Ongres scram-common < 3.3
Timeline
- 2026-06-04: patched: Version 3.3 released
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE-2026-53712 published to NVD