An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.

References

• advisory github.com
• advisory nvd.nist.gov
• advisory security.gentoo.org
• web gerrit.wikimedia.org
• web phabricator.wikimedia.org