CVE-2025-11173: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-11173 is a vulnerability in the Wikimedia Foundation's OATHAuth extension for MediaWiki, associated with the file src/Special/OATHManage.php. The vulnerability affects OATHAuth versions prior to 1.39.14, 1.43.4, and 1.44.1 (Red Hat CVE, ENISA EUVD). It was published on February 3, 2026, and assigned by the Wikimedia Foundation. The CVSS v4.0 base score is 0.0 (None) per the official scoring, though Feedly estimates the severity as HIGH based on contextual analysis (Red Hat CVE).

The vulnerability is located in src/Special/OATHManage.php within the OATHAuth MediaWiki extension, which handles two-factor authentication (2FA) management for users. The precise root cause and CWE classification have not been publicly disclosed in available sources; however, the Wikimedia Phabricator tasks T401862 and T402094 are referenced as the upstream issue trackers (ENISA EUVD). No public technical write-ups or proof-of-concept code have been identified at this time.

The concrete impact of CVE-2025-11173 has not been fully detailed in publicly available sources. Given that the affected component (OATHManage.php) governs the management of OATH-based two-factor authentication, a successful exploit could potentially affect the integrity or availability of 2FA protections for MediaWiki users, though the official CVSS v4.0 score of 0.0 indicates no direct confidentiality, integrity, or availability impact was assessed at the system level (Red Hat CVE). The vulnerability has been addressed in downstream distributions including Debian and Mageia, suggesting it was considered significant enough for security updates (Debian LTS, Debian Security).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for CVE-2025-11173. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Red Hat CVE).

Users should upgrade the OATHAuth MediaWiki extension to the patched versions: 1.39.14, 1.43.4, or 1.44.1, depending on their MediaWiki branch (ENISA EUVD). Debian has issued security advisories (DSA-6085-1 and DLA-4355-1) addressing this vulnerability as part of MediaWiki security updates (Debian Security, Debian LTS). Mageia has also released an advisory (MGASA-2025-0260) with updated packages. Administrators unable to upgrade immediately should monitor the Wikimedia Phabricator tasks T401862 and T402094 for further guidance.

The vulnerability received routine coverage from Linux security advisory aggregators and vulnerability databases following its disclosure. Debian and Mageia issued security updates, and Tenable published detection plugins (Nessus IDs 269510, 272096, 279440) for the vulnerability. A blog post by a Wikimedia developer (bawolff.net) discussing XSS protections in MediaWiki was noted in the same timeframe, though it is not confirmed to be directly related to this CVE.