CVE-2022-39387 json
XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication
published 2022-11-04 4 y ago modified 2026-06-17 4 mo ago also GHSA-m7gv-v8xx-v47w , EUVD-2022-7383
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 68%
- public exploits
- 0
- none known
Summary
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider. With the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup. This issue has been patched, please upgrade to 1.29.1. There is no workaround, an upgrade of the authenticator is required.
Patch / fix
- maven org.xwiki.contrib.oidc:oidc-authenticator 1.29.1
- xwiki openid_connect 1.29.1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.19% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.xwiki.contrib.oidc:oidc-authenticator | <1.29.1 |
1.29.1 |
Affected products
- xwiki-contrib oidc
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870ac89
web, patch, third-party-advisory
-
jira.xwiki.org
/browse/OIDC-118
web, issue-tracking, vendor-advisory
-
github.com
/xwiki-contrib/oidc/security/advisories/GHSA-m7gv-v8xx-v47w
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39387
advisory
-
github.com
/xwiki-contrib/oidc
package
Sources
- CVE List CVE-2022-39387
- GitHub Advisory GHSA-m7gv-v8xx-v47w
- NVD CVE-2022-39387
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.