Cross-Site Scripting Vulnerability in Wikimedia Foundation MediaWiki WebAuthn Extension

CVE-2025-62652

What is CVE-2025-62652?

The Wikimedia Foundation's MediaWiki WebAuthn extension is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper input neutralization during web page generation. This vulnerability could allow an attacker to inject malicious scripts that may be executed in the context of a user’s session, potentially compromising sensitive user data and the integrity of the web application. The issue affects specific versions of the extension: 1.39, 1.43, and 1.44. Ensuring updates to the latest version can help mitigate this security risk.

References