Wikipedia Android App
Monthly
The Wikipedia Android App's cookie manager could release Wikimedia CentralAuth session cookies to an attacker-controlled domain, exposing logged-in users' session tokens to interception and reuse. The flaw sits in the app's SharedPreferenceCookieManager, which matched cookie domains with a loose suffix check (`domain.endsWith(domainSpec)`) and did not require both the request domain and the cookie's stored domain to be genuine Wikimedia authorities, so a lookalike host such as a domain ending in wikipedia.org could match an approved suffix. Exploitation is not zero-click: it requires the target to be authenticated (holding CentralAuth cookies) and to be induced into making the app request the attacker's domain, which is why the vendor scores it 5.3 (medium) and our independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the underlying logic is fixed by upstream pull request 6768.
The Wikipedia Android App's cookie manager could release Wikimedia CentralAuth session cookies to an attacker-controlled domain, exposing logged-in users' session tokens to interception and reuse. The flaw sits in the app's SharedPreferenceCookieManager, which matched cookie domains with a loose suffix check (`domain.endsWith(domainSpec)`) and did not require both the request domain and the cookie's stored domain to be genuine Wikimedia authorities, so a lookalike host such as a domain ending in wikipedia.org could match an approved suffix. Exploitation is not zero-click: it requires the target to be authenticated (holding CentralAuth cookies) and to be induced into making the app request the attacker's domain, which is why the vendor scores it 5.3 (medium) and our independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the underlying logic is fixed by upstream pull request 6768.