CVE-2025-11173

InfoCVSS 0.0/10Last modified Jun 17, 2026

Description

Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php.

This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.

Metrics

CVSS 4.0 0.0/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

VendorProductVersions
Wikimedia FoundationOATHAuth< 1.39.14, 1.43.4, 1.44.1

References

Timeline

Published
Feb 3, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-111745.3The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is CVE-2025-111758.8Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The CVE-2025-111764.3The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.CVE-2025-111777.5The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 CVE-2025-111787.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (Windows) before builCVE-2025-11184.4A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory informCVE-2025-111826.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTCVE-2025-111836.9Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript cCVE-2025-111846.9Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript cCVE-2025-111856.4The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cmplz-accept-linCVE-2025-111866.4The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_acCVE-2025-111876.1Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or
CVE-2025-11173: Info severity, CVSS 0.0 | Vulnix