The vulnerability resides in the LiveTableResults component of XWiki Platform, allowing a malicious actor to reconstruct password hashes bit by bit. By issuing 768 crafted requests that probe each bit of a stored password hash, an attacker can obtain both the salt and the full hash for any user, effectively granting the ability to perform offline dictionary attacks and compromise user accounts. This represents a severe confidentiality breach because it enables the extraction of credential material that should be kept confidential.

All installations of XWiki Platform from version 6.2.1 up to, but excluding, the release versions 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17 are affected. The issue arises in the default LiveTableResults file used by the wiki. Specific product and vendor: XWiki, XWiki Platform; affected versions listed above.

The CVSS score of 7.5 indicates high severity. Although no EPSS score was reported, the exploitation logic is straightforward: a caller can repeatedly send LiveTableResults queries with tweaked parameters to deduce hash bits, which only requires reasonable network connectivity to the application. Because the attacker only needs to perform 768 requests, the attack duration is under a minute on a typical network. The vulnerability is not listed in the CISA KEV catalog, but the combination of high confidentiality impact and simple, low‑overhead attack makes it a real threat for all exposed installations of the affected XWiki Platforms.