Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3 when used for user authentication against a PostgreSQL database allows remote unauthenticated attackers to execute arbitrary code as demonstrated via the username.