CVE-2025-6597 - MediaWiki should not consider autocreation as login for the purposes of security reauthentication

MediaWiki should not consider autocreation as login for the purposes of security reauthentication

Published Feb 2, 2026

No CVSS score

EPSS 0.52%

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.

This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

Affected products

Vendor Wikimedia Foundation Product MediaWiki Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <1.39.13, 1.42.7, 1.43.2, 1.44.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Wikimedia Foundation

MediaWiki

unaffected

Version	Status	Constraints
-	affected	<1.39.13, 1.42.7, 1.43.2, 1.44.0

Remediation

Red Hat statement

The vulnerability in MediaWiki stems from its failure to consider user autocreation as a login event for security reauthentication purposes. This could impact MediaWiki instances running on Fedora 42 and Fedora 43 if user autocreation is enabled, potentially leading to unintended security bypasses during reauthentication flows.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Weaknesses (2)

CWE-22

Path Traversal

CWE-654

References (6)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2025-6597		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2436116		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206627		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-6597
https://phabricator.wikimedia.org/T389009
https://www.cve.org/CVERecord?id=CVE-2025-6597