Is CVE-2026-34087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34087 being exploited in the wild.

How severe is CVE-2026-34087?

High severity, with a CVSS score of 7.5, published 11 May 2026.

Which products and versions are affected?

Wikimedia Foundation OATHAuth Before 1.43.7, 1.44.4, 1.45.2.

Is there a fix for CVE-2026-34087?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-34087 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34087?

Check whether you run Wikimedia Foundation OATHAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34087: Wikimedia Foundation OATHAuth sensitive information exposure

CVE-2026-34087 · Severity: high · CVSS 7.5 · Published 2026-05-11

A security vulnerability has been identified in the OATHAuth extension used by Wikimedia and other MediaWiki installations to provide two-factor authentication. This flaw could allow an unauthorized individual to access sensitive information that should be protected. If exploited, this could compromise the privacy of user accounts or reveal internal configuration details, potentially aiding further attacks.

Vendors: Wikimedia Foundation.

Quick answers

Is CVE-2026-34087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34087 being exploited in the wild.
How severe is CVE-2026-34087?: High severity, with a CVSS score of 7.5, published 11 May 2026.
Which products and versions are affected?: Wikimedia Foundation OATHAuth Before 1.43.7, 1.44.4, 1.45.2.
Is there a fix for CVE-2026-34087?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-34087 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34087?: Check whether you run Wikimedia Foundation OATHAuth at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sensitive information disclosure vulnerability (CWE-200) exists in the Wikimedia Foundation OATHAuth extension. The flaw allows an authenticated attacker with low privileges to access information they are not authorized to view, provided there is some level of user interaction. The vulnerability is present in versions prior to 1.43.7, 1.44.4, and 1.45.2. While the specific nature of the exposed data is not detailed in the advisory, it typically involves cryptographic secrets or user-specific authentication metadata within the OATH framework. Patches have been released to address this issue in the affected branches.

Affected products

Wikimedia Foundation OATHAuth Before 1.43.7, 1.44.4, 1.45.2

Timeline

2026-05-11: advisory: NVD publication date
2026-05-11: disclosed: Initial disclosure by Wikimedia Foundation

References

https://phabricator.wikimedia.org/T412061

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.