Executive brief
A vulnerability in MongoDB Server's authentication process allows an unauthenticated attacker to crash the database service remotely. This occurs when the server is configured to use OpenID Connect (OIDC) for identity management. An exploit would result in a total service outage, preventing legitimate users and applications from accessing or storing data until the service is manually restored.
Technical details
The vulnerability is classified as Improper Validation of Specified Type of Input (CWE-1287) within the 'authenticate' command of MongoDB Server. When OpenID Connect (OIDC) is enabled, the server fails to properly validate specific values provided in the 'mechanism' parameter. Because the 'authenticate' command is reachable by unauthenticated clients over the network, a remote attacker can trigger a server crash (Denial of Service) without valid credentials. The issue has been addressed in MongoDB versions 8.2.10 and 8.3.3.
Affected products
- MongoDB MongoDB Server 8.2.x before 8.2.10, 8.3.x before 8.3.3
Timeline
- 2026-04-16: other: Issue created in MongoDB Jira
- 2026-06-09: patched: Fix versions 8.3.3 and 8.2.10 released
- 2026-06-09: disclosed: CVE published to NVD