A severe pre-authentication denial-of-service (DoS) vulnerability (CVE-2025-6709) has been identified in MongoDB Server, enabling attackers to crash database instances by exploiting improper input validation in OIDC authentication.

The flaw affects MongoDB Server v7.0 before 7.0.17, v8.0 before 8.0.5, and v6.0 before 6.0.21 (where authentication is required for exploitation).

With a CVSS score of 7.5 (High), this vulnerability allows unauthenticated attackers to disrupt database operations by sending malicious JSON payloads containing specially crafted date values.

Vulnerability Mechanics and Attack Vector

The vulnerability stems from improper handling of date values in JSON input during OIDC authentication processing.

Attackers can trigger an invariant failure and server crash by sending a malicious payload via MongoDB clients like the mongo shell.

The exploit specifically targets the OIDC authentication flow, where improper validation of date objects in JSON inputs causes critical failures.

Reproduction steps:

1. Establish a connection to the MongoDB Server with OIDC enabled
2. Send a crafted JSON payload containing malicious date values:

json{ "maliciousField": "2025-06-27T00:00:00Z" }

3. Observe server crash due to invariant failure.

In v7.0 and v8.0 deployments, this attack requires no authentication, while v6.0 environments require authenticated sessions for successful exploitation.

Affected Versions and Mitigation

Administrators must immediately upgrade to patched versions. Where immediate patching isn’t feasible, disabling OIDC authentication provides temporary mitigation.

MongoDB has confirmed no active exploits in the wild, but proof-of-concept reproduction is trivial using the mongo shell.

OIDC Implementation Risks

The vulnerability highlights critical risks in MongoDB’s OIDC authentication implementation.

The attack exploits the authentication flow where JSON payloads are processed before full validation, particularly in Azure Cosmos DB for MongoDB vCore configurations using OIDC:

javascriptconst client = new MongoClient(`mongodb+srv://${clusterName}.global.mongocluster.cosmos.azure.com/`, {
  authMechanism: 'MONGODB-OIDC',
  authMechanismProperties: {
    OIDC_CALLBACK: (params) => AzureIdentityTokenCallback(params, credential),
    ALLOWED_HOSTS: ['*.azure.com']
  }
});

This configuration is vulnerable when processing unvalidated date values in JSON inputs.

Database administrators should monitor authentication logs for anomalous JSON payloads containing date objects and implement strict input validation for OIDC authentication fields.

MongoDB has addressed this vulnerability in the latest patches, but it underscores persistent security challenges in database authentication mechanisms.

As enterprises increasingly adopt OIDC for cloud-native deployments, rigorous input validation and prompt patch management remain critical for securing database infrastructure.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates