CVE-2026-93394 describes a flaw in the SCRAM authentication implementation of libmongoc where the client continues the authentication handshake and transmits the client proof even if the nonce in the server's first message does not match expectations. An attacker positioned as a man-in-the-middle could exploit this by injecting a crafted server-first-message containing a controlled salt and a low iteration count, then capture the client proof to attempt offline password cracking. The vulnerability is mitigated by TLS encryption, which prevents man-in-the-middle interception in typical production deployments.

The vulnerability allows an attacker with man-in-the-middle capabilities to capture client proof data that could be used for offline password cracking. However, the impact is limited by the requirement of a man-in-the-middle position and is further mitigated by TLS, which is commonly used in production environments. The CVSS score is 3.7 (medium), reflecting limited confidentiality impact and high attack complexity.

Use of TLS is an effective mitigation, as it prevents man-in-the-middle attackers from intercepting or injecting messages in the authentication handshake. No official patch or fix is indicated in the provided data. Users should ensure TLS is properly configured and enforced in all deployments using libmongoc SCRAM authentication.