CVE-2026-53514: Predictable Mongodb Objectidcve-2026-53514-predictable-mongodb-objectid
MongoDB `ObjectId`s are predictably generated based on a timestamp, process ID, and counter. When used as primary identifiers (`id` or `_id`) in systems that assume these IDs are opaque and unguessable (like invitation tokens, session IDs, or password reset links), attackers can predict them and bypass authorization. Replace `new ObjectId()` with explicitly
