Mediawiki Centralauth Extension CVE-2026-39937

Mediawiki CentralAuth Extension on non-release branches. Remote unauthenticated attacker can exploit over network. Sensitive information improperly removed before storage/transfer, exposing user authentication data. No victim interaction required.

Real-world risk is moderate-to-high for organizations running development branches in production or exposed staging environments, but minimal for standard production deployments using stable releases. The CVSS 8.8 score reflects worst-case network exposure with no authentication barriers (AV:N/AC:L/PR:N), making exploitation technically straightforward if vulnerable endpoints are accessible. However, the explicit scope limitation to non-release branches significantly reduces exposed attack surface, as production wikis typically run tagged stable versions. No EPSS probability score is provided in the intelligence data, and absence from CISA KEV confirms no confirmed active exploitation. The CVSS vector shows low attack complexity (AC:L) and no required user interaction (UI:N), meaning automated scanning could identify vulnerable instances. SSVC decision framework would classify this as medium priority: no confirmed exploitation, potentially automatable for reconnaissance, technical impact limited to data exposure rather than system control. Organizations should prioritize remediation if development branches are internet-facing or contain production user data.

An unauthenticated remote attacker queries a MediaWiki instance running a development CentralAuth branch, triggering authentication workflows that improperly log or transmit sensitive session tokens or user credentials. By accessing publicly exposed log files, monitoring network traffic, or querying debug endpoints, the attacker harvests authentication data for legitimate users. This leaked credential material enables account takeover on the central authentication system, granting unauthorized access to all wikis within the unified login federation without needing to exploit additional vulnerabilities.