CVE-2026-126835
|
| |
|
|
Affected software |
MONGODB |
|
|
|
The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-126835 |
