CVE-2026-93394 — libmongoc SCRAM client nonce-validation bypass
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was…
Published: 2026-09-17 · CVSS: 6.3 · CVSS 4.0
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7