None · 0.0 CVE-2026-13707 EUVD-2026-41033GHSA-qjj7-573r-4398

Session fixation attacks on improperly configured OAuth 1.0a tools

Published Jul 1, 2026 · Updated Jul 1, 2026 · Assigned by wikimedia-foundation

Description

Session fixation vulnerability in Wikimedia Foundation OAuth.

This vulnerability is associated with program files src/Backend/MWOAuthServer.Php.

This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Vendor	Product	Affected	Fixed
Wikimedia Foundation	OAuth	≤ 1.46.0, 1.45.4, 1.44.6, 1.43.9	—