CVE-2026-58029 – Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

CVE ID :CVE-2026-58029

Published : July 1, 2026, 3:19 p.m. | 27 minutes ago

Description :Vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Severity: 5.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…