CVE-2026-19503CWE-20

CVE-2026-19503

Medium · published August 13, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00203 · 9.8th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-08-13T01:17Z
Affected products (2)
ProductVersionsFixed in
mongodb/odbc_driver≥ 1.0.0, < 2.0.92.0.9
mongodb/sql_schema_builder_cli≥ 1.0.1, < 1.2.11.2.1
References (1)
https://www.mongodb.com/docs/sql-interface/changelog · [email protected]
EPSS history
Timeline
  • 12 AUG 20:17Z
    Insufficient OIDC endpoint validation could invoke unintended local protocol handlers
    cvelistv5