Critical severity · published Oct 6, 2025
CVE-2025-49594
XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OI
oidc · xwiki-contrib
>= 2.17.1, < 2.18.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49594
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49594
github.com
https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb
github.com
https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7
jira.xwiki.org
https://jira.xwiki.org/browse/OIDC-240
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerability
www.vicarius.io
https://www.vicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability
More from oidc
7.5
CVE-2022-39387
XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication