Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-93394 Details

Description

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:3.7 LOWVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://jira.mongodb.org/browse/CDRIVER-6315 [email protected]Permissions Required

Weakness Enumeration

CWE-IDCWE NameSource
CWE-303Incorrect Implementation of Authentication Algorithm[email protected]

Affected Products

ProductVersions
mongodb c driver
>= 2.0.0, < 2.3.2

CPE

  • cpe:2.3:a:mongodb:c_driver:*:*:*:*:*:mongodb:*:*

Remediation

  • No remediation found in references.

Change History

3 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-93394
NVD Published Date:
Sep 17, 2026
NVD Last Modified:
Sep 25, 2026
Source:
[email protected]
CVE-2026-93394 Details - Not Deferred