CVE-2026-93394

Name of the Vulnerable Software and Affected Versions libmongoc (affected versions not specified)

Description A flaw in the SCRAM authentication implementation allows a man-in-the-middle attacker to inject a crafted server-first-message with a controlled salt and low iteration count. Because the client continues the authentication handshake and transmits the client proof despite a nonce mismatch, the attacker can capture this proof to perform offline password cracking. SCRAM (Salted Challenge Response Authentication Mechanism) is a mechanism used to authenticate users to a server without sending passwords in plain text.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Use TLS to mitigate the risk of exploitation.