What’s Vulnerable › Vulnerabilities
CVE-2026-93394: libmongoc SCRAM client nonce-validation bypass
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-17 · updated 2026-09-25
- Weakness: CWE-303
Description
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Affected products
- MongoDB C# Driver: from 2.0.0 before 2.3.2 — fixed in 2.3.2
How to fix
Upgrade to a fixed version: MongoDB C# Driver 2.3.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-93394 or the next vulnerability affects your stack