Which versions of Mediawiki Centralauth Extension are affected by EUVD-2026-19984?

CVE-2026-39937 in MediaWiki's CentralAuth extension exposes sensitive authentication data through improper handling, affecting development branches accessible over the network without authentication.

How to fix or mitigate EUVD-2026-19984?

Within 24 hours: Identify all MediaWiki instances running CentralAuth extension and document which are non-release development branches; restrict network access to development environments to authorized personnel only. Within 7 days: Consult MediaWiki security advisories and the CentralAuth extension repository for interim guidance; consider disabling CentralAuth on development builds if not critical to testing. Within 30 days: Monitor MediaWiki project for patch release; plan immediate deployment of vendor-released patch to all affected development instances once available; audit authentication logs for unauthorized access patterns during the vulnerability window.

Mediawiki Centralauth Extension EUVD-2026-19984

Q: What is the CVSS score of EUVD-2026-19984?

EUVD-2026-19984 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-39937 HIGH

Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)

2026-04-07 wikimedia-foundation

Information Disclosure Mediawiki Centralauth Extension

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 22:16 euvd

EUVD-2026-19984

Analysis Generated

Apr 07, 2026 - 22:16 vuln.today

CVE Published

Apr 07, 2026 - 21:44 nvd

HIGH 8.8

DescriptionCVE.org

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects non release branches.

AnalysisAI

Information disclosure in MediaWiki CentralAuth extension exposes sensitive authentication data to unauthorized parties through improper removal before storage or transfer. This affects non-release development branches with network-accessible attack vector requiring no authentication (CVSS:4.0 AV:N/PR:N). While no public exploit or active exploitation (not in CISA KEV) is identified at time of analysis, the CVSS 8.8 rating reflects high confidentiality impact and low complexity, making this a significant risk for organizations running development builds.

Technical ContextAI

CentralAuth is a MediaWiki extension enabling unified authentication across multiple Wikimedia wikis, managing user credentials and session tokens centrally. CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) indicates the vulnerability stems from failure to sanitize authentication-related data before persisting to logs, databases, or transmitting over networks. The CPE designation targets the CentralAuth extension specifically (cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_centralauth_extension), not core MediaWiki. The affected non-release branches suggest this issue exists in development code paths, potentially involving debugging features, verbose logging, or incomplete data sanitization routines that leak tokens, passwords, or session identifiers. The CVSS 4.0 vector showing high confidentiality impact (VC:H) with low integrity/availability impact (VI:L/VA:L) confirms the primary concern is unauthorized data exposure rather than system compromise.

RemediationAI

Apply the upstream fix committed to the MediaWiki Gerrit repository under change ID I0b72427fa329aee85841a2cb23dec3058edce85e (https://gerrit.wikimedia.org/r/q/I0b72427fa329aee85841a2cb23dec3058edce85e). Organizations running development branches should merge this commit or migrate to stable release versions of CentralAuth where the fix will be incorporated. For production wikis using official MediaWiki releases, verify that you are running stable tagged versions and not development code. As an interim workaround, restrict network access to development/staging MediaWiki instances, implement additional log sanitization at infrastructure level, and audit recent logs for potential sensitive data exposure. Review the technical discussion in Phabricator task T418122 (https://phabricator.wikimedia.org/T418122) for specific implementation details and affected code paths.