CVE-2026-58029 MediaWiki Authentication Bypass

Technical summary

CVE-2026-58029 is an authentication bypass vulnerability (CWE-287) affecting MediaWiki's authentication data management. The vulnerability exists in five key components: ApiChangeAuthenticationData.php, ApiLinkAccount.php, ApiRemoveAuthenticationData.php, SpecialLinkAccounts.php, and SpecialUnlinkAccounts.php. The flaw permits an unauthenticated, remote attacker to modify or link authentication credentials without proper authorization checks. The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects network accessibility and low attack complexity, with limited impact on confidentiality and integrity but no availability impact.

Business impact

This vulnerability could result in unauthorized account takeovers on MediaWiki installations, particularly concerning for organizations running wiki platforms for collaborative work, documentation, or community engagement. Attackers could read or modify sensitive wiki content, impersonate legitimate users, alter documentation, or inject malicious content. Organizations operating large or publicly-facing MediaWiki instances face reputational damage and potential data integrity issues, though the vulnerability's medium severity suggests it is not a critical infrastructure threat.

Affected systems

All versions of MediaWiki are affected except 1.46.0, 1.45.4, 1.44.6, and 1.43.9 (the patched releases). Any unpatched installation—whether self-hosted or managed—running versions prior to these patch releases is vulnerable. This includes legacy versions where patches may not be available, requiring administrators to plan upgrade paths carefully.

Exploitability

The vulnerability requires only network access and no authentication or user interaction, making it relatively straightforward to exploit. An attacker can trigger the flaw remotely by sending crafted requests to the affected API endpoints. However, the lack of active KEV listing suggests it is not currently weaponized in widespread attacks, though this does not diminish the need for timely patching.

Remediation

Upgrade MediaWiki immediately to one of the patched versions: 1.46.0 (latest stable), 1.45.4, 1.44.6, or 1.43.9 (LTS). Organizations unable to upgrade immediately should implement network-level controls to restrict access to the affected API endpoints (/api.php calls related to authentication) and monitor logs for suspicious authentication-related requests. Verify against vendor advisories for any additional mitigation steps specific to your deployment configuration.

Patch guidance

The Wikimedia Foundation has released patched versions addressing this issue. Administrators should prioritize upgrading to the latest stable release (1.46.0) or their supported LTS branch. Verify the version number post-patch using MediaWiki's version reporting feature (typically available in Special:Version). Test patches in a staging environment before deploying to production to ensure compatibility with extensions and local configurations. For organizations with custom authentication implementations, review any local modifications to the affected components.

Detection guidance

Monitor API logs for unusual patterns in requests to /api.php with actions like 'changeauthenticationdata', 'linkaccount', or 'removeauthenticationdata'. Alert on successful authentication changes from unexpected IP addresses or without corresponding user login sessions. Enable detailed logging on Special:LinkAccounts and Special:UnlinkAccounts pages. Review user account modification logs for unauthorized changes to authentication methods or linked accounts. Correlate failed authentication attempts with successful account changes in the same session window.

Why prioritize this

While rated MEDIUM severity, this vulnerability directly enables account compromise and affects a widely-used collaborative platform. Organizations operating MediaWiki should prioritize patching within 2–4 weeks based on their risk tolerance and whether the installation is internet-facing. The lack of known active exploitation provides a window for planned patching, but the ease of exploitation warrants urgent action.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with no authentication barriers, resulting in moderate impact to confidentiality and integrity. The score does not account for business context—the ability to compromise user accounts and alter wiki content can be significant for organizations depending on wiki accuracy and user trust. Adjust internal risk ratings upward if your MediaWiki instance is public-facing, contains sensitive documentation, or supports critical workflows.

Frequently asked questions