N/A

CVSS Score

-

CVSS Score

Basic Information

CVE ID

CVE-2025-49594

GHSA ID

GHSA-f2hf-pfrj-vrm7

EPSS Score

CWE

CWE-285

Published

10/6/2025

Updated

10/6/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49594

CVE-2025-49594: XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact

Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users).

Patches

Version 2.18.2.

Workarounds

The only workaround is to disable token access.

References

https://jira.xwiki.org/browse/OIDC-240
https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49594

CVE-2025-49594:

N/A

CVSS Score

-

CVSS Score

Basic Information

CVE ID

CVE-2025-49594

GHSA ID

GHSA-f2hf-pfrj-vrm7

EPSS Score

CWE

CWE-285

Published

10/6/2025

Updated

10/6/2025

KEV Status

Technology

Java

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.xwiki.contrib.oidc:oidc-authenticator	maven	>= 2.17.1, < 2.18.2	2.18.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-49594: XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact

Patches

Workarounds

References

For more information

CVE-2025-49594:

N/A

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

CVE-2025-49594: XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Impact

Patches

Workarounds

References

For more information

Vulnerability IntelligenceMiggo AI

WAF Protection Rules

WAF Rule

Reasoning

N/A

N/A

Basic Information

Basic Information

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI