CVE-2026-100379 — Cross-request disclosure of CentralAuth cookies in Wikipedia Android App

CVE-2026-100379

Cross-request disclosure of CentralAuth cookies in Wikipedia Android App PUBLISHED

Description (CNA)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / Wikipedia Android App	affected main

CWE

CWE-200

References

https://phabricator.wikimedia.org/T433832
https://github.com/wikimedia/apps-android-wikipedia/pull/6768

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.