MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document, allowing an attacker to supply a malicious OIDC endpoint that, when used by a client, causes the operating system's default protocol handler to be invoked. This can lead to the inadvertent execution of payloads or the exposure of credentials in the user's environment, as the client passes sensitive information to a potentially untrusted URI.

The affected products are MongoDB:Atlas SQL ODBC Driver and MongoDB:Schema Builder CLI from MongoDB. No specific version information is supplied, so any installation of these products that has not applied the current update may be vulnerable.

The CVSS score of 6.3 indicates moderate severity, and the vulnerability requires a user to connect to an uncontrolled MongoDB deployment and trigger the OIDC discovery flow, making it a local, user‑interactive attack. The EPSS score is not available and the vulnerability is not listed in KEV, suggesting it has not yet been widely exploited, but the lack of endpoint validation presents a clear opportunity for malicious actors to force the client to interact with arbitrary URIs. The risk is therefore moderate but could become higher if the client’s default protocol handler executes code without user cancellation.