Authentication Flaw in MongoDB Driver by MongoDB Inc.

CVE-2026-93394

What is CVE-2026-93394?

A security flaw in the libmongoc library compromises the SCRAM authentication process, allowing an unauthorized actor in a man-in-the-middle position to exploit nonce mismatches in server first messages. By injecting a maliciously crafted server message containing a controlled salt and a low iteration count, the attacker can manipulate the client into sending its proof, potentially leading to offline password cracking. This vulnerability emphasizes the importance of employing TLS in production settings to ensure secure communications.

References