None severity · published Feb 3, 2026
CVE-2025-11173
Reauth for enabling 2FA can be bypassed by submitting a form
0.0
CVSS
0.4%
EPSS
No
On KEV
Description
Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php.
This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OA
OATHAuth · Wikimedia Foundation
before 1.39.14, 1.43.4, 1.44.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11173
phabricator.wikimedia.org
https://phabricator.wikimedia.org/T401862
phabricator.wikimedia.org
https://phabricator.wikimedia.org/T402094
More from OATHAuth
7.5
CVE-2026-34087
Users API leaks whether privileged users have their user groups disabled for lack of 2FA