CVE-2025-11173 Reauth for enabling 2FA can be bypassed by submitting a form
Attackers can bypass reauthentication requirements when enabling two-factor authentication in MediaWiki OATHAuth by submitting a form.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-11173?
CVE-2025-11173 is an authentication bypass vulnerability in Wikimedia Foundation OATHAuth, published on 3 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php.
This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.
Which versions are affected by CVE-2025-11173?
How do I fix CVE-2025-11173?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-11173 being exploited?
There is no known exploitation of CVE-2025-11173 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-11173, GHSA-c785-g8j7-23pr, UBUNTU-CVE-2025-11173.