# CVE-2026-103047: Wikimedia MediaWiki CentralAuth stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-103047-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-103047 · Severity: info · Published 2026-09-29

The CentralAuth extension for MediaWiki, which manages unified login accounts across multiple wikis, contains a stored XSS vulnerability that allows attackers to inject malicious scripts into web pages. An attacker could craft input that, when processed by the extension, gets permanently stored and executed in the browsers of other users visiting affected pages, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of victims.

Vendors: [Wikimedia Foundation](https://junglewise.ai/threats/vendors/wikimedia-foundation).

## Quick answers

**Is CVE-2026-103047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103047 being exploited in the wild.

**How severe is CVE-2026-103047?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Wikimedia Foundation MediaWiki CentralAuth before 1.46.1, 1.45.5, 1.43.10.

**Is there a fix for CVE-2026-103047?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103047 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-103047?** Check whether you run Wikimedia Foundation MediaWiki CentralAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The CentralAuth extension improperly neutralizes user-supplied input during web page generation, enabling stored cross-site scripting (XSS). The vulnerability exists in versions before 1.46.1, 1.45.5, and 1.43.10, and requires network access to submit malicious input to the affected extension. Once stored, the injected script executes in the context of other users' sessions without requiring additional interaction.

## Affected products

- Wikimedia Foundation MediaWiki CentralAuth before 1.46.1, 1.45.5, 1.43.10

## Timeline

- 2026-09-29: disclosed

## References

- [https://gerrit.wikimedia.org/r/c/1309285](https://gerrit.wikimedia.org/r/c/1309285)
- [https://phabricator.wikimedia.org/T244682](https://phabricator.wikimedia.org/T244682)