CVE-2025-46557: 
Java vulnerability analysis and mitigation

XWiki, a generic wiki platform, was found to contain an authentication vulnerability (CVE-2025-46557) that was disclosed on April 30, 2025. The vulnerability affects versions from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16.10.0-rc-1. This issue allows users with view access to pages in the XWiki space to access the XWiki.Authentication.Administration page and potentially switch to another installed authenticator (GitHub Advisory).

The vulnerability is classified as a Missing Authorization issue (CWE-862) that allows users with view access to pages in the XWiki space to access the XWiki.Authentication.Administration page. Unless an authenticator is set in xwiki.cfg, attackers can switch to another installed authenticator. The vulnerability received a CVSS v4.0 base score of 8.4 (High) with a vector string of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N, indicating network accessibility with low attack complexity (GitHub Advisory).

The primary impact of this vulnerability varies depending on the authentication setup. By default, there is only one authenticator available (Standard XWiki Authenticator), limiting the potential impact if no additional authenticator extensions are installed. In installations using SSO authenticators (like OIDC or LDAP), an attacker could potentially break authentication by switching back to the standard authenticator. However, this is limited because users without stored passwords (typical in SSO setups) cannot be logged into (GitHub Advisory).

The vulnerability can be exploited by any user who has view access to pages in the XWiki space, which by default is available to anyone. The attack requires no special privileges or complex exploitation techniques, making it relatively straightforward to exploit in affected systems (GitHub Advisory).

The vulnerability has been patched in versions 15.10.14, 16.4.6, and 16.10.0-rc-1. For users unable to update immediately, a workaround is available by configuring page access rights. Administrators can restrict access to the XWiki.Authentication page and its children by ensuring only admin users have VIEW rights through the space administration interface (GitHub Advisory).