CVE-2025-12893
BaseFortify
Publication date: 2025-11-25
Last updated on: 2025-12-05
Assigner: MongoDB, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mongodb | mongodb | From 7.0.0 (inc) to 7.0.26 (exc) |
| mongodb | mongodb | From 8.0.0 (inc) to 8.0.16 (exc) |
| mongodb | mongodb | From 8.2.0 (inc) to 8.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows clients to successfully perform a TLS handshake with a MongoDB server even if their client certificate does not meet the documented Extended Key Usage (EKU) requirements. Specifically, a certificate missing the required 'clientAuth' EKU can still be authenticated as a client on MongoDB servers running on Windows or Apple. Similarly, MongoDB servers on Apple can establish TLS connections with servers presenting certificates missing the 'serverAuth' EKU. This means the expected certificate validation is bypassed on these platforms.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized or improperly validated certificates to be accepted during TLS handshakes with MongoDB servers on Windows or Apple platforms. This could potentially allow unauthorized clients or servers to connect securely, undermining the intended security controls and possibly exposing sensitive data or systems to unauthorized access.