CVE-2025-49594

Maven/org.xwiki.contrib.oidc:oidc-authenticator CVE-2025-49594: critical

XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view

Action: Upgrade org.xwiki.contrib.oidc:oidc-authenticator to 2.18.2 or later.

Affected

Fixed versions

Sources

• osv: GHSA-f2hf-pfrj-vrm7
• https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7
• https://nvd.nist.gov/vuln/detail/CVE-2025-49594
• https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb
• https://github.com/xwiki-contrib/oidc
• https://jira.xwiki.org/browse/OIDC-240
• https://www.vicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability

CVE-2025-49594 · published 2025-10-06T17:58:22Z · modified 2025-10-23T17:43:47Z · JSON