URI Redirection Vulnerability in Atlas SQL JDBC Driver by MongoDB

CVE-2026-120953

What is CVE-2026-120953?

A URI redirection weakness has been identified in the authentication component of the Atlas SQL JDBC Driver. This vulnerability allows an unauthenticated remote entity to exploit the driver's acceptance of endpoint addresses during an interactive sign-in flow. The driver fails to validate the scheme of the provided endpoint addresses and subsequently passes them to the local default protocol handler. As a result, if a user connects to a manipulated endpoint, harmful addresses can be opened on their system, potentially leading to adverse security outcomes. User interaction is necessary for the exploit to take effect, which highlights the need for awareness and caution during connection processes.

References