oidc vulnerabilities

2 known vulnerabilities in oidc from Xwiki-contrib. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.2 Critical severity

  oidc: Improper Authorization

  CVE-2025-49594Oct 6, 2025Xwiki-contrib

  XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token

• 7.5 High severity

  oidc: Improper Authentication

  CVE-2022-39387Nov 4, 2022Xwiki-contribEPSS 1.19%

  XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request pa