What’s Vulnerable › Products

Wikimedia Foundation Mediawiki - CentralAuth Extension vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Wikimedia Foundation Mediawiki - CentralAuth Extension version is affected

Latest Wikimedia Foundation Mediawiki - CentralAuth Extension vulnerabilities

• CVE-2026-103047 — XSS through i18n message in CentralAuth (CVSS 6.1)
• CVE-2026-100244 — CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) (CVSS 7.5)
• CVE-2026-39937 — Global vanishing does not completely remove user email (CVSS 8.8)
• CVE-2025-62669 — UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks (CVSS 6.9)
• CVE-2025-6926 — Security Authentication Bypass in CentralAuth (CVSS 8.8)