CVE-2025-6597 MediaWiki should not consider autocreation as login for the purposes of security reauthentication
Attackers can bypass security reauthentication checks by exploiting how MediaWiki handles account autocreation, potentially accessing protected features without proper verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-6597?
CVE-2025-6597 is an authentication bypass vulnerability in Wikimedia Foundation MediaWiki, published on 2 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.
This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.
Weakness: CWE-22
Which versions are affected by CVE-2025-6597?
How do I fix CVE-2025-6597?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-6597 being exploited?
There is no known exploitation of CVE-2025-6597 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-6597, GHSA-xrvg-9c6x-8hxj, UBUNTU-CVE-2025-6597.