The flaw lies in improper neutralization of delimiters when the MongoDB C# Driver constructs a connection URL, allowing untrusted text to be serialized without escaping URL or option delimiters. When the URL builder round‑trips back into a client configuration, the inserted characters are parsed as legitimate options, giving an attacker the ability to inject or suppress security‑relevant settings such as disabling TLS, altering authentication, or enabling additional drivers. This could enable a low‑privileged user to bypass authentication, downgrade encryption, or otherwise compromise the integrity of database connections. The vulnerability directly leads to unauthorized configuration changes that can undermine the security controls enforced by the database client.

All installations of the MongoDB C# Driver that use the canonical URL builder are impacted, including the version referenced in the advisory, 3.11.1, and any subsequent releases until the fix is applied. The issue is not limited to a single patch version, so any application that directly passes untrusted strings to the driver’s URL builder is potentially vulnerable.

The CVSS score of 7.1 classifies the issue as medium severity. EPSS data is not available, so the probability of exploitation cannot be quantified, but the flaw is not listed in the CISA KEV catalog. The likely attack vector is local or remote depending on how the application accepts input that is forwarded to the driver. Once the attacker controls the string passed to the URL builder, the attack can be executed immediately and does not require complex conditions.