Medium · published October 9, 2026
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
| Product | Versions | Fixed in |
|---|---|---|
| mongodb/ops_manager | ≥ 7.0.0, < 7.0.23 | 7.0.23 |
| mongodb/ops_manager | ≥ 8.0.0, < 8.0.27 | 8.0.27 |