MongoDB Node.js Driver OIDC Host Bypass Leads to Token Leak
CVE-2026-126835 Published on November 12, 2026
[Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens
The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of permitted hosts, which may result in unintended disclosure of that credential. No database account is required; the party supplying the connection configuration needs only to influence the settings the application passes to the driver.
Vulnerability Analysis
CVE-2026-126835 can be exploited with network access. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Improper Restriction of Communication Channel to Intended Endpoints
The software establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
Affected Versions
MongoDB Node.js Driver:- Version >= 6.7.0 and below 7.9.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.