CVE-2026-120953

MediumCVSS 4.3/10Last modified Nov 3, 2026

Description

A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1209543.7A weakness in the BSON library's handling of a specialized binary vector data type allows an arithmetic wraparound when computing the number CVE-2026-1209557.5The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions durin CVE-2026-1209567.1The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoin CVE-2026-1209593.7A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside the bounds of a buff CVE-2026-120975.3The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the CVE-2026-1209715.3A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by CVE-2026-1209745.3On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may no CVE-2026-1209753.1On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certifica CVE-2026-1209766.0On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication CVE-2026-1209778.2On affected platforms running Arista EOS with 802.1X with Dynamic Host Configuration Protocol (DHCP) device profiling enabled, a network-adj CVE-2026-1209786.5On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (D CVE-2026-1209798.1This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configu