CVE-2025-32068 — Revoking authorization of OAuth2 consumer does not invalidate refresh tokens

CVE-2025-32068

Revoking authorization of OAuth2 consumer does not invalidate refresh tokens PUBLISHED

Description (CNA)

Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.

Affected (CNA)

Vendor / product	Versions
The Wikimedia Foundation / Mediawiki - OAuth Extension	affected 1.39 through 1.43

CWE

CWE-863

References

https://phabricator.wikimedia.org/T336113
https://gerrit.wikimedia.org/r/q/I27b61af2cdfb862a42432e7a87b863033d540cfc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.