CVE-2025-49594
If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users).
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access.
- CVSS 4.0
- 9.2 CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285
- Source
- security-advisories@github.com
References
- https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb
- https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7
- https://jira.xwiki.org/browse/OIDC-240
- https://www.vicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.