MongoDB Atlas SQL ODBC Driver version 1.0.0 and MongoDB Schema Manager do not validate the scheme of authorization and token endpoints provided by an OIDC issuer's discovery document. This improper input validation (CWE-20) can lead to an uncontrolled URI being dispatched to the operating system's default protocol handler when a user connects to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication. The vulnerability could expose credentials or, in some cases, result in code execution within the user's context. The CVSS 4.0 base score is 6.3, reflecting a medium severity with network attack vector, low complexity, and partial impact on confidentiality and integrity.

An attacker controlling the OIDC issuer's discovery document can supply authorization and token endpoints with malicious URI schemes. When a user connects to such a MongoDB deployment using MONGODB-OIDC authentication, the system may dispatch these URIs to the operating system's default protocol handler. This can lead to credential exposure or code execution in the user's context, depending on the environment and conditions. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Users should exercise caution when connecting to untrusted MongoDB deployments using MONGODB-OIDC authentication and monitor vendor communications for updates.