Description
An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version) parameter's length.
Remediation
References
Related Vulnerabilities
Chamilo Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-33141)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1000192)
WordPress Plugin Permalink Manager Lite Cross-Site Scripting (2.2.14)
WordPress 4.3.x Directory Traversal (4.3 - 4.3.33)
WordPress Plugin Import and export users and customers Directory Traversal (1.14.2)