CVE-2015-8626

CVE-2015-8626 describes a critical vulnerability in MediaWiki versions prior to 1.23.12, 1.24.5, 1.25.4, and 1.26.1, where the User::randomPassword function generates passwords shorter than the configured minimum length. This flaw significantly weakens password security, making affected MediaWiki installations susceptible to brute-force attacks. Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. The EPSS score is low, suggesting a low probability of exploitation in the wild. Despite its high severity, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.