CVE-2025-6597: MediaWiki should not consider autocreation as login for the purposes of security reauthentication
Published Feb 2, 2026
·Updated
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.
This issue affects MediaWiki: from before 1.39.13, 1.42.7, 1.43.2, 1.44.0.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki<1.39.13, <=1.42.7, <=1.43.2, <=1.44.0
Event History
Feb 2, 2026
CVE Published
via MITRE·10:57 PM
Data Sourced
via MITRE·10:57 PM
Description
Data Sourced
via NVD·11:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-6597?
CVE-2025-6597 is classified as a security vulnerability that affects the authentication process in MediaWiki.
2
How do I fix CVE-2025-6597?
To mitigate CVE-2025-6597, upgrade MediaWiki to versions 1.39.14, 1.42.8, 1.43.3, or later.
3
Which versions of MediaWiki are affected by CVE-2025-6597?
CVE-2025-6597 affects versions of MediaWiki prior to 1.39.13, 1.42.7, 1.43.2, and up to 1.44.0.
4
What impact does CVE-2025-6597 have on MediaWiki security?
CVE-2025-6597 can lead to unauthorized access by not treating autocreation as a valid login for reauthentication.
5
Is there a workaround for CVE-2025-6597 if I cannot upgrade?
Currently, there are no published workarounds for CVE-2025-6597, and upgrading is the recommended action.