The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 12 Nov 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver. | |
| Title | [Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens | |
| Weaknesses | CWE-923 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: mongodb
Published:
Updated: 2026-11-12T17:06:05.064Z
Reserved: 2026-11-11T21:29:16.291Z
Link: CVE-2026-126835
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-12T17:17:33.147
Modified: 2026-11-12T17:17:33.147
Link: CVE-2026-126835
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses