CVE-2020-35623

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.

• CWE-20
• CWE-706

• https://github.com/CWRUChielLab/CASAuth/pull/11Patch, Third Party Advisory
• https://phabricator.wikimedia.org/T263498Exploit, Third Party Advisory
• https://github.com/CWRUChielLab/CASAuth/pull/11Patch, Third Party Advisory
• https://phabricator.wikimedia.org/T263498Exploit, Third Party Advisory

Published

Dec 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35618Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-35619Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-3562A vulnerability in the SSL/TLS inspection of Cisco Firepower…8.6
• CVE-2020-35620Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-35621Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-35622An issue was discovered in the GlobalUsage extension for Med…6.1
• CVE-2020-35624An issue was discovered in the SecurePoll extension for Medi…5.3
• CVE-2020-35625An issue was discovered in the Widgets extension for MediaWi…8.8
• CVE-2020-35626An issue was discovered in the PushToWatch extension for Med…8.8
• CVE-2020-35627Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file …8.8
• CVE-2020-35628A code execution vulnerability exists in the Nef polygon-par…9.8
• CVE-2020-35629Multiple code execution vulnerabilities exists in the Nef po…8.8