{"id":"CVE-2022-39387","aliases":["GHSA-m7gv-v8xx-v47w"],"url":"https://o3.security/vulnerability/CVE-2022-39387","summary":"XWiki OIDC Authenticator vulnerable to OpenID login bypass due to improper authentication ","details":"### Impact\n\nEven if a wiki has an OpenID provider configured through its xwiki.properties, it is possible to provide a third party provider by providing its details through request parameters. One can then bypass the XWiki authentication altogether by specifying its own provider through the oidc.endpoint.* request parameters (or by using an XWiki-based OpenID provider with oidc.xwikiprovider.\n\nWith the same approach, one could also provide a specific group mapping through oidc.groups.mapping that would make his user automatically part of the XWikiAdminGroup\n\n### Patches\n\nPatched in version 1.29.1.\n\n### Workarounds\n\nThere is no workaround, an upgrade of the authenticator is required.\n\n### References\n\nhttps://jira.xwiki.org/browse/OIDC-118\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in Jira XWiki\n* Email us at our security mailing list\n\n","published":"2022-11-04T00:00:00Z","modified":"2026-10-28T10:33:04.994193630Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.xwiki.contrib.oidc:oidc-authenticator","fixedVersion":"1.29.1"}],"fix":{"url":"https://github.com/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870ac89","label":"xwiki-contrib/oidc@0247af1"},"references":[{"type":"WEB","url":"https://jira.xwiki.org/browse/OIDC-118"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39387.json"},{"type":"ADVISORY","url":"https://github.com/xwiki-contrib/oidc/security/advisories/GHSA-m7gv-v8xx-v47w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39387"},{"type":"FIX","url":"https://github.com/xwiki-contrib/oidc/commit/0247af1417925b9734ab106ad7cd934ee870ac89"},{"type":"PACKAGE","url":"https://github.com/xwiki-contrib/oidc"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T10:33:04.994193630Z"}}