CVE-2025-32068

CVE-2025-32068: Revoking authorization of OAuth2 consumer does not invalidate refresh tokens

Vendor The Wikimedia Foundation

Product Mediawiki - OAuth Extension

Weakness CWE-863 · Incorrect authorization

Published April 11, 2025

Last update July 7, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.

Key dates

02Disclosure timeline

April 11, 2025 CVE published

July 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-32068 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2026-32693 Unauthorized access to Kubernetes secrets in Juju CVE-2026-3210 Material Icons - Moderately critical - Access bypass - SA-CONTRIB-2026-011 CVE-2017-0910 CVE-2026-42296 Argo Workflows has incomplete fix for CVE-2026-31892: hostNetwork, securityContext, serviceAccountName bypass templateReferencing Strict/Secure CVE-2023-51380 Incorrect Authorization allows Read Access to Issue Comments in GitHub Enterprise Server