Authorization session conflation

An attacker who already has an authenticated session as a user (e.g., "abc") can persist access after an administrator deletes that user, provided the attacker does not attempt any action on the session between deletion and recreation [ref_id=1]. If the administrator later recreates a user with the same name (even with a different password), the attacker's stale session becomes valid again and can be used to access database contents [ref_id=1]. The attack requires network access to the MongoDB server, prior authentication as the deleted user, and an administrator who reuses the deleted username [CWE-287].

The advisory does not specify particular functions or files. The vulnerability exists in the session and authorization management subsystem of MongoDB Server versions prior to 4.0.9, 3.6.13, and 3.4.22 [ref_id=1].

The advisory does not include a patch diff, but the fix was released in MongoDB Server v4.0.9, v3.6.13, and v3.4.22 [ref_id=1]. The vendor's remediation ensures that when a user is deleted, all existing authorization sessions for that user are properly invalidated, preventing reuse even if a user with the same name is later created [ref_id=1]. The recommended workaround is to restart any nodes that may have had active sessions after user deletion and to avoid recreating accounts with the same name as deleted accounts.

Using the mongo shell utility, an administrator creates user "abc", an attacker connects as "abc", the administrator drops user "abc", then recreates user "abc" (possibly with a different password). The attacker's original session can then execute queries such as `db.test.findOne()` without re-authenticating [ref_id=1].