Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93394— libmongoc SCRAM client nonce-validation bypass

Quick assessment

Affected
MongoDB Inc. C Driver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libmongoc 中 SCRAM 身份验证实现存在一个缺陷，导致即使检测到服务器首条消息中存在 nonce（随机数）不匹配，客户端仍会继续执行身份验证握手过程，并发送客户端证明（client proof）。处于中间人位置的未授权攻击者可利用此漏洞，通过注入一条精心构造的服务器首条消息（其中包含攻击者控制的盐值和一个较低的迭代次数），进而捕获由此生成的客户端证明，用于离线密码破解。该漏洞可通过 TLS 进行缓解，而 TLS 在生产环境中是标准部署方式。

CVSS 3.7 · Low EPSS 0.32% · P25

Affected Version Matrix 1

VendorProduct Version RangeStatus
MongoDB Inc. C Driver 2.0.0< 2.3.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93394

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libmongoc SCRAM client nonce-validation bypass
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证算法的不正确实现
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
MongoDB Inc. C Driver 2.0.0 ~ 2.3.2 -

II. Public POCs for CVE-2026-93394

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93394

请登录查看更多情报信息。

Vendor Pages for CVE-2026-93394 (1)

Same Patch Batch · MongoDB Inc. · 2026-09-17 · 6 CVEs total

CVE-2026-93393 8.1 HIGH Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream
CVE-2026-92756 5.5 MEDIUM Combining encryption settings may disable encryption
CVE-2026-92757 5.5 MEDIUM Malformed connection string may disable field level encryption
CVE-2026-92758 5.5 MEDIUM Logs may collect sensitive information
CVE-2026-93395 5.3 MEDIUM Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

IV. Related Vulnerabilities

Same product: C Driver
Same vendor: MongoDB Inc.
Same weakness: CWE-303