CVE-2026-120953
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Nov 3, 2026
CISA due date
—
The record
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local default protocol handler. An unauthenticated remote party that controls the endpoint a user elects to connect to may cause an address of its choosing to be opened on the user's system; user interaction is required.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-111754 Angular is a development platform for building mobile and desktop web applications using… CWE-601
- CVE-2026-120327 The click tracking middleware accepts an arbitrary target URL and redirects to it. CWE-601
- CVE-2024-12141 The product fails to sufficiently validate callback URLs, allowing them to be manipulated… CWE-601
- CVE-2024-2372 The affected components accept user-supplied input for constructing redirection URLs… CWE-601
- CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader… CWE-601
- CVE-2026-118425 A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an… CWE-601
- CVE-2026-118656 Echo is a Go web framework. CWE-601
- CVE-2026-118658 Echo is a Go web framework. CWE-601