OpenID Connect Authentication Flaw in MongoDB Node.js Driver

CVE-2026-126835

What is CVE-2026-126835?

The MongoDB Node.js driver has a security flaw where it inadequately applies its permitted-host restrictions during OpenID Connect (OIDC) authentication. This can lead to scenarios where a bearer token, generated through an application’s own login callback, is sent to an unintended host outside the predetermined set of allowed addresses. This oversight may cause the accidental exposure of sensitive credentials, as there are no database account prerequisites; the risk arises when an external party can influence the connection configurations passed to the driver.

References