CVE-2026-19503

Received Received - Intake

MongoDB OIDC Authentication URI Handling Flaw

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: MongoDB, Inc.

Description

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-19503

EUVD

EUVD-2026-57551

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb_schema_manager	*
mongodb	mongodb_atlas_sql_odbc_driver	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves MongoDB's Schema Manager and Atlas SQL ODBC Driver failing to validate the scheme of authorization and token endpoints from an OIDC issuer's discovery document. This could allow an attacker to redirect users to a malicious URI, potentially exposing credentials or enabling code execution in the user's environment.

Impact Analysis

If you use MONGODB-OIDC authentication and connect to an untrusted MongoDB deployment, an attacker could trick your system into sending credentials or executing malicious code through a controlled URI redirection.

Mitigation Strategies

Disable MONGODB-OIDC authentication until patches are applied. Review OIDC issuer discovery documents for unauthorized URI redirects. Monitor network traffic for unexpected protocol handler activations.

Hi! I’m here to help you understand CVE-2026-19503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70