The Wikimedia Foundation MediaWiki CentralAuth extension

• CVE-2026-103442 High 7.2 MergeAccount PHP object injection via session-key substitution 0.3%
• CVE-2026-103047 Medium 6.1 XSS through i18n message in CentralAuth 0.2%
• CVE-2026-39937 High 8.8 Global vanishing does not completely remove user email 0.3%
• CVE-2025-62669 Medium 6.9 UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks 0.5%