---
id: CVE-2025-49594
title: XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki
summary: >-
  XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki.
  Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW
  access to a user profile can create a token for that user. If that XWiki
  instance is co…
severity: none
cwe:
  - CWE-285
published: '2025-10-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T10:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-49594'
references:
  - url: >-
      https://github.com/xwiki-contrib/oidc/commit/d90d717172283aaa96bb5bb44e357f910ae64adb
    label: security-advisories@github.com
  - url: >-
      https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-f2hf-pfrj-vrm7
    label: security-advisories@github.com
  - url: 'https://jira.xwiki.org/browse/OIDC-240'
    label: security-advisories@github.com
  - url: >-
      https://www.vicarius.io/vsociety/posts/cve-2025-49594-detect-xwiki-vulnerability
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.vicarius.io/vsociety/posts/cve-2025-49594-mitigate-xwiki-vulnerability
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00442
epssPercentile: 0.36365
ingestedAt: '2026-10-09T12:53:28.888Z'
---

## Overview

XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly viewable, at least to other registered users). Version 2.18.2 contains a patch. As a workaround, disable token access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.