Vulnerability · Published Sep 30, 2026 · Assigned by wikimedia-foundation
CVE-2026-103442MergeAccount PHP object injection via session-key substitution
High 7.2
In plain English
A high-severity security flaw in MediaWiki CentralAuth extension from The Wikimedia Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Wikimedia Foundation | MediaWiki CentralAuth extension | 1.461.451.43 |
Weakness: CWE-15 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber