A flaw in libmongoc’s SCRAM authentication implementation causes the client to proceed with the handshake and transmit the client proof even when the server’s first message contains a mismatched nonce. This allows an attacker who can intercept or inject traffic to supply a crafted server-first message with a contrived salt and low iteration count, enabling the attacker to capture the client proof and perform offline password cracking. The weakness is a form of improper input validation (CWE-303).

MongoDB Inc. C Driver

The CVSS base score is 6.3, indicating a moderate severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the attack requires a man‑in‑the‑middle position, which may be realistic in untrusted networks. The vulnerability is mitigated by using TLS, which is standard in production deployments.