CVE-2026-48048

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

• CWE-359

• https://github.com/xwiki/xwiki-platform/commit/c4442716b02ffcdaa9d5e703b1db6203e36456fa
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rh28-mqj4-8x59
• https://jira.xwiki.org/browse/XWIKI-23875

Published

Aug 10, 2026

Last Modified

Aug 10, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48042Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-48043Netty is a network application framework for development of …7.5
• CVE-2026-48044Envoy is an open source edge and service proxy designed for …7.5
• CVE-2026-48045Zeroconf is a pure Python implementation of multicast DNS se…6.5
• CVE-2026-48046Streambert is a cross-platform Electron Desktop App to strea…9.3
• CVE-2026-48047XWiki Platform WebJars API is a package for XWiki, a generic…5.9
• CVE-2026-48049@hapi/inert provides static file and directory handlers for …5.3
• CVE-2026-4805The Woostify plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2026-48051Papra is a minimalistic document management and archiving pl…3.5
• CVE-2026-48052Papra is a minimalistic document management and archiving pl…5.4
• CVE-2026-48054OpenZeppelin Contracts Wizardis a web application to interac…8.8
• CVE-2026-48055Streambert is a cross-platform Electron Desktop App to strea…10