An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1.

published 2020-12-21 5 y ago modified 2026-06-17 4 mo ago also BIT-mediawiki-2020-35623 , EUVD-2020-23289

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 0; none known

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.

Patch / fix

fixed in 1 links 1

bitnami mediawiki 1.35.2

github.com/CWRUChielLab/CASAuth#11 pull request

Exploit prediction

1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

phabricator.wikimedia.org https://phabricator.wikimedia.org/T263498 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	mediawiki	<1.35.2	1.35.2

Classification

Weakness

CWE-20 Improper Input Validation
CWE-706 Use of Incorrectly-Resolved Name or Reference

References

github.com /CWRUChielLab/CASAuth/pull/11
patch, third-party-advisory, web
phabricator.wikimedia.org /T263498
exploit, third-party-advisory, web
nvd.nist.gov /vuln/detail/CVE-2020-35623
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary