CVE-2025-11173: OATHAuth Auth Bypass Vulnerability

CVE-2025-11173 Overview

A vulnerability has been identified in the Wikimedia Foundation OATHAuth extension, specifically within the src/Special/OATHManage.Php file. This component is responsible for managing two-factor authentication (2FA) operations in MediaWiki installations using the OATHAuth extension. Organizations running affected versions should review their deployments and apply appropriate updates.

Critical Impact
Vulnerability in OATHAuth authentication management component affecting multiple MediaWiki versions prior to 1.39.14, 1.43.4, and 1.44.1.

Affected Products

OATHAuth versions prior to 1.39.14
OATHAuth versions prior to 1.43.4
OATHAuth versions prior to 1.44.1

Discovery Timeline

2026-02-03 - CVE CVE-2025-11173 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-11173

Vulnerability Analysis

The vulnerability exists within the OATHAuth extension for MediaWiki, specifically in the OATHManage.Php special page handler. OATHAuth provides OATH-based two-factor authentication capabilities for MediaWiki installations, allowing users to add an additional layer of security to their accounts through time-based one-time passwords (TOTP).

The affected file src/Special/OATHManage.Php handles the management interface for OATH authentication tokens. While the precise technical details of the vulnerability mechanism are not fully disclosed in the public advisories, the issue appears to involve the special page's handling of authentication-related operations.

Root Cause

The root cause of this vulnerability is located in the OATHManage.Php special page implementation. Based on the affected component path and the nature of the OATHAuth extension, the issue likely involves improper handling within the authentication management workflow. The vulnerability was tracked internally by Wikimedia through their Phabricator issue tracking system under tasks T401862 and T402094.

Attack Vector

The vulnerability is accessible via network-based attack vectors, meaning remote attackers could potentially interact with the affected component without requiring local system access. The OATHManage special page is typically accessible to authenticated users managing their two-factor authentication settings.

Since no verified code examples are available for this vulnerability, technical details should be referenced from the official Wikimedia Phabricator tasks linked in the external references section.

Detection Methods for CVE-2025-11173

Indicators of Compromise

Unusual activity patterns in OATHAuth management page access logs
Unexpected modifications to user OATH authentication configurations
Anomalous requests to the Special:OATHManage endpoint

Detection Strategies

Monitor web server access logs for suspicious requests targeting Special:OATHManage or related OATHAuth endpoints
Review MediaWiki audit logs for unexpected changes to two-factor authentication settings
Implement web application firewall (WAF) rules to detect and alert on unusual parameter patterns in requests to the OATHManage special page

Monitoring Recommendations

Enable verbose logging for the OATHAuth extension to capture detailed activity records
Set up alerts for multiple failed or unusual OATH management operations within short time windows
Regularly audit user authentication configuration changes through MediaWiki's logging infrastructure

How to Mitigate CVE-2025-11173

Immediate Actions Required

Update OATHAuth to version 1.39.14, 1.43.4, or 1.44.1 or later depending on your MediaWiki branch
Review recent activity on the OATHManage special page for any suspicious operations
Audit user OATH configurations for unauthorized changes

Patch Information

Wikimedia Foundation has released patched versions of the OATHAuth extension that address this vulnerability. The fix is included in OATHAuth versions 1.39.14, 1.43.4, and 1.44.1. Users should update to the appropriate version based on their MediaWiki installation branch. For detailed patch information, refer to the Wikimedia Phabricator tasks T401862 and T402094.

Workarounds

If immediate patching is not possible, consider temporarily restricting access to the Special:OATHManage page through MediaWiki permission settings
Implement additional access controls at the web server level to limit who can access OATHAuth management endpoints
Monitor OATHAuth-related activity closely until the update can be applied

bash

# Example: Restrict access to OATHManage in LocalSettings.php
# Add to your MediaWiki LocalSettings.php to limit access
$wgGroupPermissions['*']['oathauth-enable'] = false;
$wgGroupPermissions['user']['oathauth-enable'] = false;
$wgGroupPermissions['sysop']['oathauth-enable'] = true;