Description

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-12T21:17:38.383Z",
  "pubdate": "2026-08-12T21:17:38.383Z",
  "executiveSummary": "A vulnerability exists in the MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver involving improper validation of the authorization and token endpoint schemes provided within an OpenID Connect (OIDC) issuer discovery document.\nThe vulnerability allows an attacker capable of inducing a user to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication to force the dispatch of an arbitrary or uncontrolled Uniform Resource Identifier (URI) directly to the underlying operating system's default protocol handler.\nThe primary impact of this flaw includes the potential exposure of sensitive user credentials and, under specific environmental conditions, remote code execution (RCE) executing directly within the security context of the victim user.\nExploitation requires user interaction to initiate a connection to a malicious or compromised MongoDB deployment utilizing the MONGODB-OIDC authentication mechanism.\nThis vulnerability poses a significant risk to client systems utilizing the affected MongoDB drivers and management tools, as successful exploitation leverages trusted operating system mechanisms against the user.",
  "technicalDetails": "The root cause of the vulnerability stems from an absolute lack of schema validation on the authorization and token endpoints returned by an OIDC issuer's discovery document within the MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver.\nDuring the MONGODB-OIDC authentication handshake, the client application retrieves the OIDC configuration from a discovery document hosted by the authentication issuer.\nBecause the affected components fail to validate whether the scheme of the authorization and token endpoints conforms to expected safe protocols (such as HTTPS), a malicious MongoDB deployment can supply arbitrary schemes.\nStep-by-step attack flow: First, an attacker establishes an uncontrolled MongoDB deployment configured to return a maliciously crafted OIDC issuer discovery document containing arbitrary or specially formatted URI schemes in the endpoint fields.\nSecond, the victim is induced to initiate a connection to this malicious MongoDB deployment using MONGODB-OIDC authentication.\nThird, the MongoDB Schema Manager or MongoDB Atlas SQL ODBC Driver parses the malicious discovery document and processes the unvalidated endpoints.\nFourth, when the driver attempts to interact with or dispatch requests to these endpoints, the underlying system hands the malformed or malicious URI over to the operating system's default protocol handler.\nFifth, depending on the crafted URI and how the operating system handles it, this can result in the leakage of sensitive authentication tokens or credentials to external entities, or lead to arbitrary code execution if the protocol handler invokes vulnerable local applications with malicious parameters.\nThe vulnerable components are the OIDC discovery parsing logic residing within the MongoDB Schema Manager and the MongoDB Atlas SQL ODBC Driver.\nAuthentication requirements for the client involve attempting to authenticate via MONGODB-OIDC, while the attacker requires control over a malicious MongoDB deployment serving the spoofed OIDC discovery document."
}