CVE-2022-39387

XWiki OIDC authenticator (prior to 1.29.1) is vulnerable to authentication bypass by supplying a custom OpenID provider through request parameters (oidc.endpoint.* or oidc.xwikiprovider) and can also map the user to XWikiAdminGroup via oidc.groups.mapping. This stems from improper authentication ...