CVE-2020-25827

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

• CWE-307

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Vendor Advisory
• https://phabricator.wikimedia.org/T251661Exploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Vendor Advisory
• https://phabricator.wikimedia.org/T251661Exploit, Vendor Advisory

Published

Sep 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2582Vulnerability in the Oracle iStore product of Oracle E-Busin…8.2
• CVE-2020-25820BigBlueButton before 2.2.7 allows remote authenticated users…6.5
• CVE-2020-25821peg-markdown 0.4.14 has a NULL pointer dereference in proces…7.5
• CVE-2020-25824Telegram Desktop through 2.4.3 does not require passcode ent…2.4
• CVE-2020-25825In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can rev…7.5
• CVE-2020-25826PingID Integration for Windows Login before 2.4.2 allows loc…7.8
• CVE-2020-25828An issue was discovered in MediaWiki before 1.31.10 and 1.32…6.1
• CVE-2020-25829An issue has been found in PowerDNS Recursor before 4.1.18, …7.5
• CVE-2020-2583Vulnerability in the Java SE, Java SE Embedded product of Or…3.7
• CVE-2020-25830An issue was discovered in MantisBT before 2.24.3. Improper …4.8
• CVE-2020-25832Reflected Cross Site scripting vulnerability on Micro Focus …5.4
• CVE-2020-25833Persistent cross-Site Scripting vulnerability on Micro Focus…4.8