CVE-2026-93394
lowpriority · track · 0EPSS 0.003 · 25 %ileDEUSEPSS · scored 2026-10-27
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–6.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (11)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3453MongoDB C Driver und Entity Framework Core Provider: Mehrere SchwachstellenDeutsch2026-09-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in MongoDB ausnutzen, um Informationen offenzulegen oder um einen Denial-of-Service-Zustand herbeizuführen.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
- https://jira.mongodb.org/browse/CDRIVER-6315Permissions Required
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan