Authentication Bypass in Scratch Login (mediawiki-scratch-login)
Priority MEDIUM 45CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
Why it matters now
EPSS 0.01174 67th percentileScored 2026-11-07
Fix Fixed mediawiki-scratch-login (InternationalScratchWiki): 1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| InternationalScratchWiki | mediawiki-scratch-login | before 1.1 | 1.1 | Patch available | CNA |
- mediawiki-scratch-login VendorInternationalScratchWiki Affected before 1.1 Fixed in 1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:scratch-wiki:scratch_login:*:*:*:*:*:mediawiki:*:* | before 1.1 | Vulnerable | Scratch-wiki |
- cpe:2.3:a:scratch-wiki:scratch_login:*:*:*:*:*:mediawiki:*:* Versions before 1.1 Vulnerable ·Scratch-wiki
Remediation
- Fix · CNA mediawiki-scratch-login (InternationalScratchWiki) Fixed in 1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-15164
References
More Scratch-wiki Scratch Login vulnerabilities
- TI-2022-20963 The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure… CVSS 3.1MEDIUM 4.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences