CVE-2026-19503

Insufficient OIDC endpoint validation could invoke unintended local protocol handlers

State: Published
Severity: 6.3 Medium
Published: Aug 12, 2026
Updated: Aug 13, 2026
Reserved: Aug 10, 2026

Description

MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N	mongodb
3.1	4.8 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	mongodb

Weaknesses

CWE-20 Improper input validation

Affected Products

Product	Versions
Atlas SQL ODBC DriverMongoDB	1.0.0 to before 2.0.9Affected
Schema Builder CLIMongoDB	1.0.1 to before 1.2.1Affected

References

https://www.mongodb.com/docs/sql-interface/changelog

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.