Vulnerability · Published Sep 17, 2026 · Assigned by mongodb
CVE-2026-93394libmongoc SCRAM client nonce-validation bypass
Low 3.7
In plain English
A low-severity security flaw in C Driver from MongoDB Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mongo-c-driver | no fix listed | DEBIAN-CVE-2026-93394 |
| Debian:13 | mongo-c-driver | no fix listed | DEBIAN-CVE-2026-93394 |
| Debian:14 | mongo-c-driver | 2.4.0-1 | DEBIAN-CVE-2026-93394 |
| Ubuntu:26.04:LTS | mongo-c-driver | no fix listed | UBUNTU-CVE-2026-93394 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| MongoDB Inc. | C Driver | 2.0.0 – before 2.3.2 |
Weakness: CWE-303 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N