The MongoDB C# Driver considers two TLS client certificates identical if they share the same issuer and serial number, regardless of the private key. An attacker who supplies a certificate with the same issuer and serial number as a legitimate user’s certificate can obtain cached connections that have already been authenticated as that user. This permits the attacker to execute database operations under the other user’s identity, thereby compromising the confidentiality and integrity of data accessible to that identity.

MongoDB’s C# Driver is affected. Any deployment that employs a version of the driver where client certificates are compared solely on issuer and serial number is vulnerable, particularly before the driver was released at version 3.13.0. Users running those versions should verify the driver version they are currently using.

The CVSS score is 7.6, indicating a high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is an application that accepts TLS client certificates from users and reuses cached connections; the attacker only needs to supply a certificate with matching issuer and serial number, not the private key, making exploitation relatively straightforward in environments where certificate validation logic is insufficiently strict.