CVE-2026-103047: XSS through i18n message in CentralAuth
Published Sep 29, 2026
·Updated
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS.
This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki CentralAuth Extension<1.46.1, <1.45.5, <1.43.10
Event History
Sep 29, 2026
CVE Published
via MITRE·10:59 PM
Data Sourced
via MITRE·10:59 PM
DescriptionWeakness
Data Sourced
via NVD·11:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which CentralAuth versions are affected?
The issue affects CentralAuth versions before 1.46.1, 1.45.5, and 1.43.10.
2
What type of impact can exploitation have?
The vulnerability allows stored cross-site scripting through an i18n message, meaning attacker-controlled script content may be persisted and later executed when rendered in a web page.