CVE-2015-8624

The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.

• CWE-352

• http://www.openwall.com/lists/oss-security/2015/12/21/8Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/23/7Mailing List, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.htmlPatch, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T119309Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/21/8Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/12/23/7Mailing List, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-December/000186.htmlPatch, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T119309Patch, Third Party Advisory

Published

Mar 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8618The Int.Exp Montgomery code in the math/big library in Go 1.…
• CVE-2015-8619The Human Monitor Interface support in QEMU allows remote at…7.5
• CVE-2015-8620Heap-based buffer overflow in the Avast virtualization drive…7.8
• CVE-2015-8621t-coffee before 11.00.8cbe486-2 allows local users to write …
• CVE-2015-8622Cross-site scripting (XSS) vulnerability in MediaWiki before…
• CVE-2015-8623The User::matchEditToken function in includes/User.php in Me…
• CVE-2015-8625MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x befor…
• CVE-2015-8626The User::randomPassword function in MediaWiki before 1.23.1…
• CVE-2015-8627MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x befor…
• CVE-2015-8628The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyCo…
• CVE-2015-8629The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in k…5.3
• CVE-2015-8630The (1) kadm5_create_principal_3 and (2) kadm5_modify_princi…