by Kastro
Paper/Archive/CVE-2025-49594

CVE-2025-49594

xwiki-contrib oidc — XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 38.4.384 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access.

Affected

ProductAffectedFixed inSource
oidc>= 2.17.1, < 2.18.2–CNA

Scores by source

GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7refgithub.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adbrefjira.xwiki.org/browse/OIDC-240refvicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerabilityrefvicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability