CVE-2026-9742

Authenticate command with specific mechanism parameter can trigger server crash

State: Published
Severity: 8.2 High
Published: Jun 9, 2026
Updated: Jun 10, 2026
Reserved: May 27, 2026

Description

When OIDC authentication is enabled in configuration, clients may set specific values in the "mechanism" parameter of the "authenticate" command that lead to server crash. The authenticate command is accessible to unauthenticated clients, leading to pre-auth denial-of-service in affected product configurations.

Scores

CVSS	Score	Vector	Source
4.0	8.2 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	mongodb
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	mongodb

Weaknesses

CWE-1287 Improper validation of specified type of input

Affected Products

Product	Versions
MongoDB ServerMongoDB	8.3.0 to before 8.3.3Affected 8.2.0 to before 8.2.10Affected

References

https://jira.mongodb.org/browse/SERVER-124183

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.