CVE-2026-13707: Wikimedia OAuth Auth Bypass Vulnerability

CVE-2026-13707 Overview

CVE-2026-13707 is a session fixation vulnerability [CWE-384] in the Wikimedia Foundation OAuth extension for MediaWiki. The flaw resides in the src/Backend/MWOAuthServer.Php component, which handles OAuth authorization flows. An attacker who supplies a pre-created session identifier to a victim can hijack the authenticated session after the victim completes OAuth authorization. The issue affects all OAuth extension releases through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. Exploitation requires user interaction and low-privileged access, but the vulnerability is reachable over the network.

Critical Impact
Successful session fixation allows an attacker to impersonate an authenticated MediaWiki user via a hijacked OAuth session, enabling unauthorized actions under the victim's identity.

Affected Products

Wikimedia Foundation OAuth extension versions up to and including 1.46.0
Wikimedia Foundation OAuth extension versions up to and including 1.45.4
Wikimedia Foundation OAuth extension versions up to and including 1.44.6 and 1.43.9

Discovery Timeline

2026-07-01 - CVE-2026-13707 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13707

Vulnerability Analysis

The vulnerability is a session fixation weakness in the OAuth server implementation within src/Backend/MWOAuthServer.Php. Session fixation occurs when an application accepts a session identifier supplied by an external party and does not rotate that identifier after authentication. In the affected OAuth flow, the session identifier associated with a user is not regenerated at the point authorization is granted. An attacker who plants or shares a known session identifier with a victim retains valid access to that session once the victim authenticates through the OAuth authorization endpoint.

The defect enables account impersonation without requiring the attacker to steal credentials, tokens, or cookies after the fact. Wikimedia tracked the underlying engineering work in Wikimedia Task T428324.

Root Cause

The root cause is the failure to invalidate or regenerate the session identifier during the OAuth authorization transition. Secure session handling requires issuing a new session identifier when a user's privilege level changes, particularly at authentication and authorization boundaries. The affected OAuth server code path reuses the incoming session identifier, allowing a pre-set value to persist across the authentication event.

Attack Vector

An attacker delivers a crafted URL or link containing a known session identifier to a target MediaWiki user. The victim opens the link and completes the OAuth authorization step on the wiki. Because the session identifier is not rotated, the attacker's session is now bound to the victim's authenticated identity. The attacker can then act as the victim within the scope granted to the OAuth consumer. User interaction is required, and the attack path traverses the network to the OAuth authorization endpoint.

No verified public exploit code is available for CVE-2026-13707. See the Wikimedia Task T428324 advisory for technical details.

Detection Methods for CVE-2026-13707

Indicators of Compromise

OAuth authorization requests where the same session identifier is observed from multiple distinct client IP addresses or user-agent strings within a short window.
Successful OAuth grants immediately following requests that arrive with a pre-existing session cookie not previously issued by the server.
Unusual OAuth consumer authorizations for privileged wiki accounts that were not initiated by the account holder.

Detection Strategies

Correlate MediaWiki access logs and OAuth authorization events by session identifier to surface sessions used across mismatched client fingerprints.
Alert when an inbound request to the OAuth authorization endpoint presents a session cookie that the server did not issue in a recent Set-Cookie response.
Review OAuth consumer approval events for accounts with elevated wiki privileges and compare against expected user activity.

Monitoring Recommendations

Enable verbose logging on MWOAuthServer request handling to capture session identifier lifecycle events across authorization transitions.
Track OAuth grant volume per consumer and per user, and flag statistically anomalous spikes tied to session reuse patterns.
Preserve web server and reverse proxy logs with client IP, user-agent, and cookie hashes for retrospective session-fixation analysis.

How to Mitigate CVE-2026-13707

Immediate Actions Required

Upgrade the Wikimedia OAuth extension to a fixed release beyond 1.46.0, 1.45.4, 1.44.6, or 1.43.9 on the corresponding MediaWiki branch.
Invalidate all active OAuth-issued sessions and access grants after patching to remove any potentially fixated sessions.
Audit recent OAuth consumer authorizations, especially for administrator and bot accounts, and revoke any that cannot be attributed to legitimate user activity.

Patch Information

Wikimedia Foundation addressed the session fixation issue in the OAuth extension through the code change tracked in Wikimedia Task T428324. Administrators should apply the maintenance release corresponding to their supported MediaWiki branch (1.43, 1.44, 1.45, or 1.46) and confirm the OAuth extension reports a version higher than the affected releases listed above.

Workarounds

Force session identifier rotation at the reverse proxy or load balancer for requests hitting the OAuth authorization endpoint until the patch is applied.
Restrict OAuth consumer approvals to trusted networks or require re-authentication for the authorization step.
Communicate to users to avoid opening OAuth authorization links received from untrusted sources on the affected wiki.

bash

# Verify installed OAuth extension version on a MediaWiki host
php maintenance/showJobs.php --help >/dev/null 2>&1
grep -R "'version'" extensions/OAuth/extension.json