CVE-2026-19503 in Atlas SQL ODBC Driver
Summary
by MITRE • 08/13/2026
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an OIDC issuer's discovery document. A user induced to connect to an uncontrolled MongoDB deployment using MONGODB-OIDC authentication may have an uncontrolled URI dispatched to their operating system's default protocol handler, potentially exposing credentials or, under certain conditions, resulting in code execution in the user's context.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability resides in the MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver implementations that fail to properly validate the scheme of authorization and token endpoints obtained from OpenID Connect issuer discovery documents. The flaw represents a critical security oversight where the authentication system blindly accepts URI schemes without verifying their legitimacy, creating a potential attack vector for man-in-the-middle scenarios. When users connect to MongoDB deployments using MONGODB-OIDC authentication mechanisms, the system retrieves endpoint URIs through the standard OIDC discovery process but fails to validate that these endpoints use secure protocols such as https rather than potentially dangerous schemes like http or custom URI handlers.
The technical implementation issue stems from insufficient input validation within the OIDC discovery response processing logic. According to CWE-20, this vulnerability manifests as an input validation flaw where the application accepts untrusted data without proper sanitization or verification of URI schemes. The authentication flow becomes compromised when a malicious actor can manipulate the discovery document to return endpoints with non-standard schemes that redirect to arbitrary protocols handled by the user's operating system. This weakness allows for protocol handler abuse where the system might execute commands through default handlers like mailto:, file:, or custom application protocols, effectively bypassing normal security boundaries.
The operational impact of this vulnerability extends beyond simple credential exposure to potentially enabling remote code execution under specific conditions. When users navigate to untrusted MongoDB deployments and the system processes a maliciously crafted discovery response, the operating system's default protocol handler may be invoked with attacker-controlled parameters. This scenario aligns with ATT&CK technique T1566 which describes social engineering attacks involving the manipulation of user systems through protocol handlers. The vulnerability becomes particularly dangerous when combined with user interaction requirements, as it leverages human factors in security breaches rather than purely technical exploits.
Security mitigation strategies should focus on implementing strict URI scheme validation during OIDC discovery processing, ensuring that all endpoints use secure protocols before being accepted for authentication operations. Organizations must enforce HTTPS-only requirements for all OIDC endpoints and implement proper validation mechanisms that reject non-standard or potentially dangerous URI schemes. The fix should include comprehensive input sanitization of discovery document responses, with explicit checks against allowed protocol handlers and automatic rejection of suspicious endpoint configurations. Additionally, security-conscious default configurations should be implemented to prevent the system from accepting custom URI schemes that could lead to unintended system interactions, particularly in environments where user trust levels vary significantly.