Password Hash Disclosure in XWiki Platform by XWiki
CVE-2026-48048
What is CVE-2026-48048?
The XWiki Platform contains a vulnerability that allows unauthorized access to user password hashes. An insufficient patch means that even with modified parameters, it is possible to retrieve password hashes with repeated requests. Users need to be aware that, by sending a specific number of requests, an attacker could potentially reconstruct the full password hash and salt for a user account. This flaw persists in XWiki versions prior to 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17, highlighting the need for immediate updates or manual patches to safeguard sensitive user information.
Affected Version(s)
xwiki-platform >= 6.2.1, < 16.10.17 < 6.2.1, 16.10.17
xwiki-platform >= 17.0.0-rc-1, < 17.4.9 < 17.0.0-rc-1, 17.4.9
xwiki-platform >= 17.5.0-rc-1, < 17.10.3 < 17.5.0-rc-1, 17.10.3