CVE-2020-25827

PoC —

CVSS 3.1

7.5 high

EPSS

2%p77

Published

Sep 27, 2020 (Sep 27, 2020)

Modified

Jun 17, 2026

Description

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

Vendors: mediawiki fedoraproject
Products: mediawiki, fedora
Weakness: CWE-307
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news0 stories

No ingested article mentions this CVE yet.