CVE-2026-19503

Awaiting Analysis Awaiting Analysis - Queue

MongoDB OIDC Authentication URI Handling Flaw

Publication date: 2026-08-12

Last updated on: 2026-08-28

Assigner: MongoDB, Inc.

Description

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19503

EUVD

EUVD-2026-57551

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_schema_manager	*
mongodb	mongodb_atlas_sql_odbc_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves MongoDB's Schema Manager and Atlas SQL ODBC Driver failing to validate the scheme of authorization and token endpoints from an OIDC issuer's discovery document. This could allow an attacker to redirect users to a malicious URI, potentially exposing credentials or enabling code execution in the user's environment.

Detection Guidance

This vulnerability cannot be directly detected through standard network or system commands as it involves improper handling of OIDC issuer endpoints in MongoDB deployments. Focus on auditing MongoDB configurations for MONGODB-OIDC authentication usage and verifying that only trusted OIDC issuers are configured.

Impact Analysis

If you use MONGODB-OIDC authentication and connect to an untrusted MongoDB deployment, an attacker could trick your system into sending credentials or executing malicious code through a controlled URI redirection.

Compliance Impact

This vulnerability could potentially expose user credentials or allow code execution, which may lead to unauthorized access to sensitive data. This could violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by compromising confidentiality and integrity of personal or protected health information.

Mitigation Strategies

Disable MONGODB-OIDC authentication until patches are applied. Review OIDC issuer discovery documents for unauthorized URI redirects. Monitor network traffic for unexpected protocol handler activations.

Hi! I’m here to help you understand CVE-2026-19503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70