TLS Handshake Vulnerability in MongoDB Server for Windows and Apple

CVE-2025-12893

What is CVE-2025-12893?

This vulnerability allows clients to complete a TLS handshake with MongoDB servers despite presenting a client certificate that does not meet the Extended Key Usage (EKU) requirements. Specifically, client certificates lacking the 'clientAuth' specification may still be authenticated successfully. This problem is notably present in MongoDB Server when operating on Windows or Apple environments, as these systems do not enforce the expected certificate validation behavior seen in Linux. Furthermore, MongoDB servers on Apple can establish outgoing TLS connections with servers presenting invalid server certificates that do not fulfill the necessary EKU requirements, again bypassing authentication checks. This allows potential misconfigurations that could lead to unauthorized access.

References