CVE-2026-58029: MediaWiki Auth Bypass Vulnerability

CVE-2026-58029 is an authentication bypass vulnerability in Wikimedia MediaWiki affecting API authentication modules. Attackers can circumvent access controls in versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2026-58029 Overview

CVE-2026-58029 is an authentication weakness [CWE-287] affecting the Wikimedia Foundation MediaWiki platform. The flaw resides in account linking and authentication data management components, including includes/Api/ApiChangeAuthenticationData.php, includes/Api/ApiLinkAccount.php, includes/Api/ApiRemoveAuthenticationData.php, includes/Specials/SpecialLinkAccounts.php, and includes/Specials/SpecialUnlinkAccounts.php. An attacker can exploit the issue over the network with no privileges but requires user interaction. The vulnerability affects MediaWiki versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

Critical Impact
Successful exploitation can compromise the integrity and confidentiality of authentication data used for linking and unlinking user accounts on MediaWiki instances.

Affected Products

MediaWiki versions before 1.43.9
MediaWiki versions 1.44.x before 1.44.6 and 1.45.x before 1.45.4
MediaWiki versions before 1.46.0

Discovery Timeline

2026-07-01 - CVE-2026-58029 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58029

Vulnerability Analysis

The vulnerability is classified under [CWE-287] Improper Authentication. It affects five MediaWiki source files responsible for managing authentication credentials and account linking workflows. These components handle sensitive operations such as changing authentication data, linking additional identity providers to an account, and removing authentication factors.

The attack vector is network-based and requires user interaction, which is consistent with authentication flows that involve a victim clicking a link or submitting a form. The scope changes indicate that the confidentiality and integrity impacts extend beyond the immediate authenticated component into linked subsystems.

The EPSS probability is 0.543% with a percentile of 41.6, indicating a modest likelihood of exploitation attempts within the near-term horizon.

Root Cause

The root cause is improper enforcement of authentication requirements within the API and Special Page handlers that manage credential and account link state. The affected handlers in ApiChangeAuthenticationData.php, ApiLinkAccount.php, ApiRemoveAuthenticationData.php, SpecialLinkAccounts.php, and SpecialUnlinkAccounts.php do not sufficiently validate the requesting session before mutating authentication data.

Attack Vector

A remote attacker can craft requests targeting the vulnerable authentication endpoints and induce a victim to trigger the request through user interaction. Once triggered, the flaw allows manipulation of authentication data belonging to the interacting user. Detailed exploitation logic is not published in the referenced advisory. See the Wikimedia Task T422676 for technical details.

Detection Methods for CVE-2026-58029

Indicators of Compromise

Unexpected calls to the MediaWiki API modules changeauthenticationdata, linkaccount, or removeauthenticationdata originating from unusual IPs or referrers.
Access log entries for Special:LinkAccounts or Special:UnlinkAccounts that do not correlate with legitimate user session activity.
Unexplained modifications to user and authentication related database tables outside of administrative workflows.

Detection Strategies

Correlate MediaWiki access logs with authentication event logs to identify account linking operations that lack a preceding valid login event.
Alert on high-frequency requests to the affected API endpoints from single client identifiers.
Compare running MediaWiki version strings against the patched releases 1.43.9, 1.44.6, 1.45.4, and 1.46.0 to identify vulnerable hosts.

Monitoring Recommendations

Enable verbose logging for MediaWiki's AuthManager and forward events to a centralized SIEM.
Monitor web application firewall (WAF) telemetry for suspicious POST requests to api.php with actions related to authentication data.
Track outbound email notifications for account link and unlink operations and reconcile against user-reported activity.

How to Mitigate CVE-2026-58029

Immediate Actions Required

Upgrade MediaWiki to a fixed version: 1.46.0, 1.45.4, 1.44.6, or 1.43.9, whichever matches your release branch.
Audit recent account link and unlink activity for anomalous entries following the disclosure date.
Force session invalidation for administrative and privileged accounts after patching.

Patch Information

Wikimedia Foundation has released fixed MediaWiki versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0. Refer to the Wikimedia Task T422676 for patch references and upgrade guidance.

Workarounds

Restrict access to the MediaWiki API and authentication-related Special Pages using web server access controls until patches are applied.
Disable account linking features via MediaWiki configuration if they are not required by the deployment.
Deploy WAF rules that require valid CSRF tokens and authenticated session cookies for requests to the affected endpoints.

bash

# Configuration example: restrict access to authentication endpoints in nginx
location ~ ^/w/(api\.php|index\.php\?title=Special:(Link|Unlink)Accounts) {
    allow 10.0.0.0/8;
    deny all;
}