CVE-2026-48048: 
Java vulnerability analysis and mitigation

CVE-2026-48048 is an information disclosure vulnerability in XWiki Platform's LiveTableResults macro that allows unauthenticated remote attackers to reconstruct full password hashes one bit at a time. It is a bypass of a previously issued patch for GHSA-5cf8-vrr8-8hjm, where slightly modified parameters to LiveTableResults still expose password salt and hash data. The vulnerability affects org.xwiki.platform:xwiki-platform-livetable-ui versions >= 6.2.1 and < 16.10.17, >= 17.0.0-rc-1 and < 17.4.9, and >= 17.5.0-rc-1 and < 17.10.3. It was published on May 21, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, XWiki Advisory).

The root cause is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The original fix for GHSA-5cf8-vrr8-8hjm checked the property class using $class.get($colname), but this logic could be bypassed by supplying a per-property class via a modified request parameter (e.g., password_class), causing the macro to use the wrong property class for password and email field type checks. The fix in commit c4442716b replaces the check with a call to #livetable_getPropertyClassAndType, which correctly resolves the property class regardless of how the request is parameterized. No authentication or special privileges are required to exploit this vulnerability — an attacker only needs network access to the XWiki instance (GitHub Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to extract the full password salt and hash of any XWiki user by issuing approximately 768 crafted HTTP requests, recovering one bit of the hash per request. This exposes credentials to offline cracking attacks, potentially enabling account takeover for any user on the affected XWiki instance, including administrators. There is no integrity or availability impact, but the confidentiality impact is rated High due to the exposure of sensitive authentication material (GitHub Advisory, XWiki Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit by any network-accessible attacker. The CVE status is currently "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score or threat actor attribution is currently available (GitHub Advisory).

1. Reconnaissance: Identify internet-facing XWiki instances running affected versions (>= 6.2.1 and < 16.10.17, >= 17.0.0-rc-1 and < 17.4.9, or >= 17.5.0-rc-1 and < 17.10.3) using tools like Shodan or Censys, or by checking the XWiki version page.
2. Identify target user: Determine the username of the target account (e.g., Admin or any known user) whose password hash is to be extracted.
3. Craft malicious LiveTableResults requests: Send HTTP requests to the XWiki LiveTableResults endpoint with modified parameters, including a password_class parameter pointing to a custom or per-property class, and a password filter parameter set to a specific bit-testing value.
4. Bit-by-bit hash extraction: Iterate through approximately 768 requests, each probing a single bit of the password salt and hash by observing whether the LiveTable query returns results or not (binary oracle). Record the response for each request to reconstruct the full hash.
5. Offline password cracking: Use the recovered password salt and hash with offline cracking tools (e.g., Hashcat or John the Ripper) to attempt to recover the plaintext password.
6. Account takeover: Use the cracked credentials to authenticate to the XWiki instance and gain access as the targeted user (GitHub Advisory, XWiki Advisory).

• Network: A high volume (~768+) of HTTP requests to the XWiki LiveTableResults endpoint (typically /xwiki/bin/get/XWiki/LiveTableResults) from a single IP address in a short time window, with parameters including password, password_class, and collist.
• Logs: XWiki access logs showing repeated requests to the LiveTableResults endpoint with unusual query parameters such as password_class=XWiki.MyClass or similar per-property class overrides; requests with incrementally varying password filter values.
• Logs: Patterns of binary (0/1 result count) responses to LiveTableResults queries targeting password fields, which may appear in application or web server logs as alternating empty/non-empty result sets.

XWiki has released patched versions: 16.10.17, 17.4.9, and 17.10.3 (also referenced as 17.10.13 and 18.0.0RC1 in the advisory). Administrators should upgrade to one of these versions as the primary remediation. As a temporary workaround, the patch can be applied manually by editing the wiki page XWiki.LiveTableResultsMacros to use #livetable_getPropertyClassAndType for property class resolution, as detailed in the patch commit (GitHub Advisory, Patch Commit).