This vulnerability, identified as CWE-384 (Session Fixation), exists in the Wikimedia Foundation OAuth component, specifically in the src/Backend/MWOAuthServer.Php file. It affects multiple OAuth versions up to 1.46.0 and related subversions. Session fixation vulnerabilities allow an attacker to fixate a user's session identifier, potentially enabling unauthorized access if the victim authenticates using the fixed session. No remediation level or patch information is currently available from the vendor, and no exploits have been reported in the wild.

The vulnerability could allow an attacker to hijack a user's session by forcing a known session identifier, potentially leading to unauthorized access to user accounts or services relying on the OAuth implementation. However, no active exploitation has been reported, and the exact impact depends on the deployment and usage of the affected OAuth versions.

Patch status is not yet confirmed — check the Wikimedia Foundation vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the vendor and consider additional session management controls if possible.