Xwiki-Contrib Oidc vulnerabilities

CVE-2025-49594 [CRITICAL] CWE-285 CVE-2025-49594: XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.1 XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user (since users are very commonly vi

CVE-2022-39387 [HIGH] CWE-287 CVE-2022-39387: XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1 XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provi