Copyright © 2012 Red Hat, Inc. All rights reserved. Critical 2026-07-01T18:23:02 wikilambda: WikiLambda Extension: Authentication bypass due to improper input neutralization 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-140

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

A flaw was found in The Wikimedia Foundation Mediawiki - WikiLambda Extension. This vulnerability, caused by improper neutralization of input terminators, allows an attacker to bypass authentication. This could lead to unauthorized access to the system.

This Critical flaw in the Mediawiki WikiLambda Extension allows an unauthenticated attacker to bypass authentication mechanisms due to improper input neutralization. This could lead to unauthorized access to systems where the WikiLambda Extension is deployed and enabled, posing a significant risk to data integrity and confidentiality. To mitigate this vulnerability, disable the MediaWiki WikiLambda Extension if it is not required for your deployment. This can typically be achieved by commenting out or removing the extension's entry in the LocalSettings.php configuration file. Restricting network access to the MediaWiki instance to trusted networks or users can also reduce exposure. Disabling the extension will affect any functionality dependent on WikiLambda. https://www.cve.org/CVERecord?id=CVE-2026-58517 https://nvd.nist.gov/vuln/detail/CVE-2026-58517 https://gerrit.wikimedia.org/r/c/1305376 https://phabricator.wikimedia.org/T428833