CVE-2026-93394

Katalog CVE

CVSS 3.7 · Low EPSS 0,32%

Kerentanan Incorrect Implementation of Authentication Algorithm pada mongodb c driver. Skor CVSS 3.1 3.7 (Low) menurut mongodb.com.

Deskripsi (NVD)

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

25 September 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber mongodb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://jira.mongodb.org/browse/CDRIVER-6315 permissions required