CVE-2025-49594: fallo crítico en xwiki-contrib oidc
XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
Publicada el · Actualizada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.4%
probabilidad de explotación
0.4%top 63% de las CVE
explotación observada
noninguna fuente lo reporta
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
xwiki-contrib · oidcCVEs relacionadas — xwiki-contrib oidc
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adbhttps://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7https://jira.xwiki.org/browse/OIDC-240https://www.vicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability