CVE-2026-13707 Session fixation attacks on improperly configured OAuth 1.0a tools

None 0.0 Published 1 Jul 2026 Updated 1 Jul 2026

Attackers can hijack user sessions via fixation in improperly configured OAuth 1.0a tools, requiring configuration changes or patches.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-13707?

CVE-2026-13707 is an authentication bypass vulnerability in Mediawiki Mediawiki, published on 1 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Session fixation vulnerability in Wikimedia Foundation OAuth.

This vulnerability is associated with program files src/Backend/MWOAuthServer.Php.

This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Weakness: CWE-384

Which versions are affected by CVE-2026-13707?

It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2026-13707?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-13707 being exploited?

There is no known exploitation of CVE-2026-13707 in the wild and no public exploit code.

All Mediawiki Mediawiki vulnerabilities

Sources

Also known as GHSA-qjj7-573r-4398, MINI-643p-4735-rfgj, MINI-64vc-3jwj-64hh, MINI-x276-f8c3-cp38.