PgBouncer 1.6.x prior to 1.6.1, when configured with auth_user, allows remote malicious users to gain login access as auth_user via an unknown username.
pgbouncer pgbouncer 1.6