CVE-2026-120953
Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
| CWE | CWE-601 |
| Vendor | mongodb |
| Product | atlas sql jdbc driver |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for mongodb atlas sql jdbc driver
Be the first to know when new medium vulnerabilities affecting mongodb atlas sql jdbc driver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
MongoDB / Atlas SQL JDBC Driver
2.1.2 < 4.0.1