Improper authentication in MediaWiki - CVE-2025-6597
Published: August 7, 2025
Vulnerability identifier: #VU113752
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-6597
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to logic error in the autocreation process, which shares its logic with the user login flow via the AuthManager::setSessionDataForUser() method. A remote attacker can bypass authentication process and take over accounts of other web application users.
Affected software
MediaWiki
Debian Linux
mediawiki (Debian package)
Debian Linux
mediawiki (Debian package)
How to mitigate CVE-2025-6597
Install updates from vendor's website.
MediaWiki - addressed in versions 1.39.13, 1.42.7, 1.43.2
mediawiki (Debian package) - update to 1:1.39.13-1~deb12u1
mediawiki (Debian package) - update to 1:1.39.13-1~deb12u1