CVE-2019-15150: Schine.games Mw-OAUTH2CLIENT

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function.

Affected products

• Schine.games Mw-OAUTH2CLIENT: before 0.4 (fixed in 0.4)

Published 2019-08-19. Last modified 2026-06-17.