CVE-2026-93394: mongodb inc. c driver

Vulnerability summary

CVE-2026-93394 is a medium (CVSS 6.3) vulnerability in mongodb inc. c driver. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.7% of scored vulnerabilities.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.

• CWE-303Incorrect Implementation of Authentication AlgorithmThe requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.