CVE-2025-46557
📋 TL;DR
This vulnerability allows any user with access to XWiki pages to switch authentication methods, potentially disrupting authentication systems. It affects XWiki installations with specific version ranges where users can access the XWiki space. The impact varies based on installed authenticators.
💻 Affected Systems
- XWiki
📦 What is this software?
Xwiki by Xwiki
Xwiki by Xwiki
Xwiki by Xwiki
⚠️ Risk & Real-World Impact
Worst Case
Authentication system disruption causing denial of service or unauthorized access if alternative authenticators with weaker security are available.
Likely Case
Temporary authentication disruption by switching to incompatible authenticator, requiring administrator intervention to restore service.
If Mitigated
Minimal impact if only default authenticator is installed or proper access controls are implemented.
🎯 Exploit Status
Exploitation requires authenticated access to XWiki pages but no special privileges beyond default page access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.10.14, 16.4.6, or 16.10.0-rc-1
Vendor Advisory: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f9c6-2f9p-82jj
Restart Required: Yes
Instructions:
1. Identify current XWiki version. 2. Upgrade to patched version: 15.10.14, 16.4.6, or 16.10.0-rc-1. 3. Restart XWiki service. 4. Verify authentication functionality.
🔧 Temporary Workarounds
Restrict XWiki Space Access
allLimit access to pages in XWiki space to administrators only
Configure XWiki rights to restrict 'view' and 'edit' permissions on XWiki.* pages to admin users only
Remove Authenticator Switching Page
allDelete or restrict access to XWiki.Authentication.Administration page
Delete page XWiki.Authentication.Administration or set restrictive permissions
🧯 If You Can't Patch
- Implement strict access controls on XWiki space pages
- Monitor authentication logs for unusual authenticator switching attempts
🔍 How to Verify
Check if Vulnerable:
Check XWiki version against affected ranges and verify access to XWiki.Authentication.Administration pageCheck Version:
Check XWiki administration interface or xwiki.properties file for version informationVerify Fix Applied:
Confirm version is 15.10.14, 16.4.6, or 16.10.0-rc-1 and test authenticator switching functionality📡 Detection & Monitoring
Log Indicators:
- Authentication method change events
- Access to XWiki.Authentication.Administration page by non-admin users
Network Indicators:
- Unusual authentication failures following configuration changes
SIEM Query:
source="xwiki" AND (event="authentication_change" OR page="XWiki.Authentication.Administration")