Wikimedia OAuth CVE-2026-13707

EUVD-2026-41033 NONE

Session Fixation (CWE-384)

2026-07-01 wikimedia-foundation

GHSA-qjj7-573r-4398

Session Fixation Information Disclosure PHP Oauth

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

8.7 HIGH

Session fixation enabling full session hijack warrants S:C with C:H and I:H; PR:L and UI:R reflect OAuth consumer access and victim interaction requirements.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:06 vuln.today

DescriptionCVE.org

Session fixation vulnerability in Wikimedia Foundation OAuth.

This vulnerability is associated with program files src/Backend/MWOAuthServer.Php.

This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.

Technical ContextAI

The vulnerability resides in src/Backend/MWOAuthServer.php within the Wikimedia Foundation OAuth extension (CPE: cpe:2.3:a:wikimedia_foundation:oauth:*:*:*:*:*:*:*:*), a PHP-based OAuth 1.0a/2.0 server layer that mediates third-party application access to MediaWiki installations. CWE-384 (Session Fixation) occurs when an application assigns a session token prior to authentication and fails to regenerate it upon successful login. In an OAuth context, this typically manifests as the authorization server accepting an externally-supplied or predictable state/session token during the authorization handshake - allowing an attacker who seeds a specific token to reuse it once a victim completes authentication against that seeded identifier.

RemediationAI

Upgrade the Wikimedia Foundation OAuth extension to a version beyond the affected maxima on each maintained branch - that is, beyond 1.46.0, 1.45.4, 1.44.6, or 1.43.9 on the respective 1.46.x, 1.45.x, 1.44.x, and 1.43.x lines. Exact confirmed patched release versions are not available in the current data set; consult the vendor advisory at https://phabricator.wikimedia.org/T428324 for confirmed fix versions before deploying. If immediate patching is not possible, restrict OAuth consumer registration to vetted, internally-controlled applications only, which eliminates the ability of external actors to initiate the crafted authorization flow. Disabling the OAuth extension entirely removes the attack surface at the cost of all third-party MediaWiki integrations. Monitor OAuth authorization logs for unusual session token patterns as a detection compensating control.