CVE-2015-8008: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token.

Affected products

• Fedoraproject Fedora: version 21 only; version 22 only; version 23 only
• Mediawiki Mediawiki: before 1.25.3 (fixed in 1.25.3)

Published 2017-12-29. Last modified 2026-06-17.