Threats Tagged 'cve-2026-93394'

A vulnerability in libmongoc's SCRAM authentication allows a client to proceed with authentication and send client proof despite a nonce mismatch in the server's initial message. This flaw could enable a man-in-the-middle attacker to inject a malicious server-first-message with controlled parameters, capturing client proof for offline password cracking. The issue is mitigated by the use of TLS, which is standard in production environments.

A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a nonce mismatch was detected in the server's first message. An unauthorized party with a man-in-the-middle position could exploit this by injecting a crafted server-first-message containing a controlled salt and low iteration count, then capturing the resulting client proof to perform offline password cracking. This vulnerability is mitigated by TLS, which is standard in production deployments.