Wikimedia OAuth CVE-2026-13707

The attacker must possess low-level access sufficient to register or interact with an OAuth consumer on the target MediaWiki installation (PR:L per the CVSS 4.0 vector). A victim user must follow a crafted OAuth authorization URL and complete authentication interactively (UI:P). The Wikimedia Foundation OAuth extension must be installed and active, with its OAuth server functionality reachable over the network. Exploitation is confined to installations running affected branch versions (through 1.46.0, 1.45.4, 1.44.6, or 1.43.9). Restricting OAuth consumer registration to pre-approved internal applications significantly limits the pool of actors who can initiate the attack. The vendor-assigned zero-impact CVSS 4.0 vector suggests additional undocumented conditions may further constrain exploitability; these are not confirmed from available data.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N) records zero confidentiality, integrity, and availability impact across both vulnerable and subsequent systems, which is atypical for a session fixation flaw that classically enables full session hijacking. This scoring may reflect that the vulnerability does not guarantee session takeover in isolation, or it may be a conservative vendor assessment. No EPSS score is available; no CISA KEV listing exists; and no public POC has been identified, all of which reduce urgency relative to other session-class vulnerabilities. The 'Information Disclosure' tag conflicts with the zero-impact CVSS vector and is not reconciled in available data - security teams should treat the actual impact as unconfirmed pending clarification from the vendor advisory at https://phabricator.wikimedia.org/T428324 before deprioritizing this issue solely on the basis of the zero-impact vector.

An attacker registers a low-privilege OAuth consumer on the target MediaWiki instance and crafts an authorization URL that supplies a fixed or attacker-known session token in the OAuth handshake processed by MWOAuthServer.php. The attacker delivers this URL to a target user who follows it and completes authentication; the pre-seeded session token is then promoted to an authenticated session. The attacker, holding the known session token, subsequently accesses the victim's account without any further interaction. No public proof-of-concept code has been identified at time of analysis.