CVE-2026-13707
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Session fixation vulnerability in the Wikimedia Foundation OAuth extension. An attacker can force a victim to use a known session identifier, potentially leading to session hijacking.
Risk Assessment
The organization risks unauthorized access to OAuth user accounts, which could lead to data theft or actions performed on behalf of the victim.
Recommendation
Immediately update the OAuth extension to version 1.46.1 or later, and implement session identifier regeneration after login.
Other vulnerabilities in OAuth
See all- CVE-2026-58422Critical
A vulnerability in the OAuth sign-in callback mechanism silently re-enables accounts that were disabled by an administrator. Improper authorization allows bypassing administrative account lockout decisions.
- CVE-2026-54605High
A vulnerability in the OAuth Ruby library allows an attacker to capture the Authorization header during a redirect. The OAuth::Consumer client follows a 3xx redirect, which can mutate the configuration and expose sensitive data.
Original NVD description (English source)
Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.