DBClientConnection::auth and sub-calls should ensure that the authentication parameters BSON does not contain invalid entries. For example, the password entry below is incorrect, but the client will not report any error and just proceed as if no password was specified.

                BSONObjBuilder b;
                b << "mechanism" << argv[2] <<
                     "user" << argv[3] <<
                     "password" << argv[4] <<
                     "clientLogLevel" << 1;