A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. The driver accepts endpoint addresses from a remote endpoint without validating the URI scheme and forwards the resulting address to the local default protocol handler. The flaw can cause an attacker‑controlled address to be opened on the user’s system. The weakness allows an unauthenticated remote party that controls the endpoint a user chooses to connect to to induce the local machine to request any URI, potentially leading to phishing, malware delivery, or other malicious outcomes. The flaw is cataloged as CWE‑601: URL Redirection to Untrusted Site.

MongoDB Atlas SQL JDBC Driver versions 4.0.0 and earlier. Products affected are the Atlas SQL JDBC Driver supplied by MongoDB; no other vendors are listed.

The CVSS base score is 5.1, indicating moderate severity. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, so existing exploitation activity is not widely reported. The likelihood of exploitation depends on an attacker gaining control of a remote endpoint that a user connects to, and requires the target to interact with the resulting URI. The attack is user‑interaction dependent, so while the exploit is non‑zero‑day, it does not deliver remote code execution without the user's involvement.