EUVD-2026-82438
GHSA-cxv8-vf43-xcw5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because it requires a man-in-the-middle position on non-TLS traffic; C:L reflects offline crackable proof capture, with no integrity or availability impact and no authentication needed (PR:N).
Primary rating from Vendor (mongodb).
CVSS VectorVendor: mongodb
Lifecycle Timeline
2DescriptionCVE.org
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
AnalysisAI
SCRAM authentication in the MongoDB C Driver (libmongoc) fails to abort when a nonce mismatch is detected in the server's first message, so the client continues the handshake and still transmits its client proof. An unauthenticated, on-path attacker who can inject a crafted server-first message containing an attacker-controlled salt and a low iteration count on a plaintext connection can capture that proof and brute-force the password offline. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an active man-in-the-middle / on-path position on the network connection between a libmongoc client (C Driver 2.0.0 to <2.3.2) and the MongoDB server, AND the connection must be plaintext or have TLS stripped/absent - the vendor explicitly states TLS mitigates the flaw, so any deployment using TLS (standard in production) is not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely moderate-to-low real-world risk despite the 6.3 CVSS 4.0 score, and the score is honest about it via the AT:P (attack requirement present) and VC:L/VI:N/VA:N impact metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading the MongoDB C Driver / libmongoc to version 2.3.2 or later, the first release outside the affected 2.0.0 <2.3.2 range, and track the fix via the MongoDB JIRA advisory at https://jira.mongodb.org/browse/CDRIVER-6315. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. Rated medium
Heap-based buffer overflow in the TLS transport layer of the MongoDB C Driver on Windows TLS-backend builds allows the e
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected mul
Double-free memory corruption in the MongoDB C Driver's OpenSSL-based TLS certificate revocation checking path allows a
Incorrect validation of files loaded from a local untrusted directory may allow local privilege escalation if the underl
Connection-option injection in the MongoDB C# Driver allows a low-privileged application user to introduce or suppress s
NoSQL injection in the MongoDB C# Driver's LINQ-to-aggregation translation layer allows network-accessible, unauthentica
Denial of service in applications using the MongoDB C Driver's libbson library can be triggered by crafted BSON input wi
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated part
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cau
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today