MongoDBCVE-2026-93394
A flaw in libmongoc's SCRAM authentication implementation caused the client to...
Medium6.3CVE-2026-93394 · Published Sep 17, 2026 · updated Sep 25, 2026
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| C Driver Product | >= 2.0.0, < 2.3.2 | 2.3.2 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-303
More MongoDB advisories
All MongoDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 18 | MongoDB Mongoid: unsafe reflection | High8.3 | No fix yet |
| Sep 18 | Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream | High8.1 | 1.30.11+1 more |
| Sep 17 | Insertion of Sensitive Information into Log File | Medium5.7 | 8.4.4 |
| Sep 17 | Silent plaintext storage of encrypted fields via mis-keyed encryption map in the EF Core provider | Medium6.8 | 8.4.4 |
| Sep 17 | MongoDB C Driver: integer overflow | Medium6.9 | 2.3.1 |
| Sep 17 | MongoDB Entity Framework Core Provider: missing encryption | Medium6.8 | 8.4.3+2 more |