CVE-2026-103047 in MediaWiki
Summary
by MITRE • 09/30/2026
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.
This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a critical security flaw within the Wikimedia Foundation's MediaWiki platform, specifically targeting the CentralAuth extension prior to versions 1.46.1, 1.45.5, and 1.43.10. This issue is classified as an improper neutralization of input during web page generation, commonly known as cross-site scripting or XSS. The specific nature of this vulnerability allows for stored cross-site scripting attacks, which distinguishes it from reflected variants by persisting the malicious payload within the application's data store rather than merely transmitting it through a single request and response cycle. This persistence mechanism significantly amplifies the potential impact on system integrity and user safety.
At its core, the technical flaw stems from insufficient validation or encoding of user-supplied input before it is rendered in HTML contexts by the CentralAuth extension. When an attacker submits specially crafted data that contains executable JavaScript code, the application fails to properly sanitize this input. Consequently, when other users access pages where this malicious content is displayed, their browsers execute the injected script. This behavior violates fundamental web security principles regarding output encoding and context-aware sanitization, allowing client-side scripts to run with the privileges of the affected user session.
The operational impact of a stored XSS vulnerability in an authentication-related extension like CentralAuth is severe due to its potential for widespread exploitation across interconnected wiki instances. Attackers can leverage this flaw to steal sensitive information such as session cookies, which may lead to account takeover and unauthorized access to privileged administrative functions. Furthermore, the malicious script can perform actions on behalf of the victim, including modifying user profiles, changing passwords, or redirecting users to phishing sites designed to harvest credentials. In environments where CentralAuth manages single sign-on across multiple wiki projects, a successful exploit could compromise not just one account but potentially propagate trust issues across the entire federated identity infrastructure managed by Wikimedia Foundation services.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The stored nature of the attack also relates to CWE-834: Excessive Iterative Reloading and potentially CWE-611 if it involves XML external entity injection depending on implementation details, though XSS is the primary vector. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1059.007: JavaScript under Execution Environment, which describes how attackers use scripts to execute malicious actions within a victim's browser context without requiring additional software installation or privilege escalation on the server side.
Mitigation strategies must prioritize immediate patching of the MediaWiki platform and its extensions to the specified safe versions that address these input handling deficiencies. Administrators should ensure that all instances running CentralAuth are updated to version 1.46.1, 1.45.5, or 1.43.10 or later as soon as possible. In addition to software updates, implementing a Web Application Firewall with robust XSS detection rules can provide an additional layer of defense by blocking malicious payloads before they reach the application logic. Security teams should also enforce strict Content Security Policy headers that restrict script execution sources and disable inline scripts where feasible, thereby mitigating the impact even if input validation fails in future releases. Regular security audits focusing on output encoding practices within custom extensions are essential to prevent similar vulnerabilities from arising in other components of the MediaWiki ecosystem.