CVE-2026-34087 — Users API leaks whether privileged users have their user groups disabled for lack of 2FA

Affected: Wikimedia Foundation OATHAuth

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.

This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

USN-8315-1 — mediawiki vulnerabilities

Affected: Ubuntu:Pro:20.04:LTS: mediawiki, Ubuntu:Pro:22.04:LTS: mediawiki, Ubuntu:Pro:24.04:LTS: mediawiki

It was discovered that MediaWiki incorrectly handled group membership visibility in the OATHAuth extension. An authenticated attacker could use this issue to determine if other users had two-factor authentication enabled. (CVE-2026-34087)

It was discovered that MediaWiki incorrectly handled suppressed log entry titles in the RecentChanges list. An unauthenticated attacker could use this issue to view titles of deleted or suppressed pages that should be hidden. (CVE-2026-34088)

It was discovered that MediaWiki incorrectly handled resource loading timing information. An attacker could use this issue to determine if certain pages existed on a wiki. (CVE-2026-34092)

Most recent entries from all

CVE-2026-34087 — Users API leaks whether privileged users have their user groups disabled for lack of 2FA

USN-8315-1 — mediawiki vulnerabilities