CVE-2026-100244 in MediaWiki
Summary
by MITRE • 09/29/2026
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.
This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in the Wikimedia Foundation's MediaWiki CentralAuth extension represents a critical information disclosure flaw that enables unauthorized actors to excavate sensitive user data. This issue specifically impacts versions of the CentralAuth module prior to releases 1.46.1, 1.45.5, and 1.43.10. The core technical deficiency lies in how the extension handles authentication state and session management across multiple wiki instances within a unified account system. When an attacker interacts with specific endpoints or exploits race conditions during the login process, they can trigger error messages or response payloads that inadvertently reveal internal database structures, user identifiers, or cryptographic nonces associated with active sessions. This exposure is not merely cosmetic but provides actionable intelligence that facilitates further exploitation attempts against the authentication infrastructure.
From a technical perspective, this vulnerability aligns closely with CWE-209, which describes the generation of an error message that includes sensitive information about the software environment. In the context of CentralAuth, the flaw likely stems from insufficient sanitization or conditional logic errors when processing cross-wiki login requests. The extension is designed to synchronize user accounts across a network of wikis, and this complexity introduces attack surfaces where state inconsistencies can be leveraged. By carefully crafting requests that force the system into error states under specific timing conditions, an attacker can observe variations in response times or content differences. These side-channel indicators allow for the reconstruction of valid session tokens or the identification of existing user accounts without direct authentication credentials.
The operational impact of this vulnerability is significant due to its potential role as a precursor to more severe attacks such as account takeover or privilege escalation. While the immediate result is information leakage, the data obtained can be used to target specific high-privilege users within the Wikimedia ecosystem. Attackers may use the excavated identifiers to perform targeted phishing campaigns or attempt brute-force attacks against known usernames with higher success rates due to reduced search space. Furthermore, exposure of session-related metadata can aid in bypassing security controls that rely on opaque token values for validation. For a platform hosting millions of users and critical collaborative content, even partial compromise of authentication integrity undermines the trust model essential for open collaboration platforms.
This vulnerability is also relevant to MITRE ATT&CK technique T1078, specifically Valid Accounts, as it aids in reconnaissance phases where attackers gather information about valid user identities before launching direct attacks. Additionally, it relates to CWE-200 and CWE-359 regarding exposure of private information through improper handling of sensitive data during processing. The ability to excavate this information effectively lowers the barrier for entry into the system, allowing adversaries who previously lacked specific credentials to gain a foothold by exploiting these informational leaks.
Mitigation strategies must prioritize immediate patching to the specified safe versions 1.46.1, 1.45.5, or 1.43.10 depending on the current deployment version. Administrators should verify that all instances of MediaWiki running CentralAuth are updated simultaneously to prevent cross-version exploitation scenarios where a vulnerable node could be used as an entry point into a patched network segment. In addition to patching, implementing strict rate limiting on authentication endpoints can mitigate the effectiveness of timing-based attacks and error message analysis. Monitoring logs for unusual patterns in login failures or specific HTTP status codes associated with internal errors will help detect ongoing exploitation attempts. Security teams should also review access controls around debug modes and ensure that verbose error reporting is disabled in production environments to minimize information leakage vectors even if similar flaws exist elsewhere in the application stack.