FWIW, this is repeatable in the following way:

1. open an xwiki page as an unauthenticated user. Xwiki will redirect to the SSO provider
2. wait for several minutes for the original SSO request to age out
3. Log in as prompted by the SSO provider
4. Xwiki–presented now with a valid login from an expired auth request–will present the 500 error as above.