CVE-2026-13707: MediaWiki OAuth Session Fixation Vulnerability (CVSS 7.6)

Technical summary

CVE-2026-13707 is a session fixation vulnerability (CWE-384) residing in the MWOAuthServer.php file within Wikimedia's OAuth backend. The vulnerability allows an authenticated or semi-privileged attacker to manipulate session handling during the OAuth flow, causing a legitimate user's session to be associated with a session identifier controlled by the attacker. When the user authenticates, they become bound to this attacker-controlled session, enabling account takeover. The CVSS 3.1 score of 7.6 (HIGH) reflects the requirement for low authentication privileges and user interaction, balanced against high impact to confidentiality and integrity with some impact to availability.

Business impact

Organizations running MediaWiki instances with OAuth authentication face account compromise risk where OAuth-authenticated sessions can be hijacked. This is particularly concerning for wiki deployments serving as content management or collaboration platforms, where account takeover could lead to unauthorized content modification, sensitive information disclosure, and potential lateral movement within integrated systems. The requirement for user interaction somewhat limits attack scale, but successful exploitation still grants attackers the full privileges of compromised accounts.

Affected systems

MediaWiki OAuth is affected across multiple versions: all versions through 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Organizations should verify their exact MediaWiki and OAuth component versions. While version information extends to 1.46.0, the patch status for 1.47 and later versions should be confirmed against official Wikimedia security advisories to ensure no gaps exist in your patching strategy.

Exploitability

Exploitation requires network access and authenticated credentials (PR:L), making it less immediately exploitable in open-access scenarios but dangerous in environments where OAuth is used for authenticated collaboration. Successful exploitation also requires user interaction (UI:R), typically clicking a link crafted by the attacker. No exploit code is known to be publicly weaponized as of the advisory date, and this vulnerability is not tracked on CISA's Known Exploited Vulnerabilities catalog, though this does not guarantee absence of active exploitation.

Remediation

Apply patches for affected versions immediately: update to patched releases of 1.46, 1.45, 1.44, or 1.43 as appropriate for your deployment. Wikimedia has released security updates addressing this issue; consult the official Wikimedia security advisories for exact patch version availability. If immediate patching is not feasible, consider temporarily disabling OAuth-based authentication in favor of alternative authentication mechanisms, or restricting OAuth access to trusted internal networks only.

Patch guidance

Obtain patches from Wikimedia Foundation's official security advisories and release notes. Download and test patches in a staging environment before production deployment to ensure compatibility with your MediaWiki configuration and extensions. Apply patches following your standard change management procedures. Given the HIGH severity and account compromise nature of this vulnerability, expedited testing and deployment is warranted—aim for completion within 7–14 days depending on your environment's risk profile.

Detection guidance

Monitor OAuth session handling for anomalies: look for session identifiers established by one user being accessed by another, or unusual patterns of session creation preceding user authentication. Enable MediaWiki logging for OAuth events and review logs for: (1) multiple failed OAuth authentications from the same user, (2) session IDs appearing in logs before corresponding successful authentication, and (3) subsequent account activity inconsistent with user behavior baselines. Implement network detection rules to flag suspicious OAuth callback URLs or parameter tampering.

Why prioritize this

This vulnerability warrants HIGH priority due to its impact on account confidentiality and integrity, the relative ease of exploitation (low privilege, but user interaction required), and the critical nature of OAuth in modern authentication stacks. Although not yet tracked on CISA's KEV list, the session fixation class of vulnerability has a proven attack history. Prioritize patching for MediaWiki instances used in high-value collaboration or content management contexts, and for instances that serve external users or contain sensitive information.

Risk score, explained

The CVSS 3.1 score of 7.6 reflects: Network-based attack vector (AV:N) with low attack complexity (AC:L), but requiring low privileges (PR:L) and user interaction (UI:R). The impact is High for confidentiality and integrity (account takeover), with Low impact to availability. This places it firmly in the HIGH severity tier—serious enough to demand rapid response, but not at the critical severity level that would indicate widespread, unauthenticated, or immediate widespread exploitation.

Frequently asked questions