This issue has been created
There are 3 updates.
 
 
XWiki Platform / cid:jira-generated-image-avatar-72eaed6c-8a59-4bce-bc1b-67491537abd0 XWIKI-25199 Open

PasswordClass related error when login with Admin after an instance upgrade

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-e169111e-86e6-42d5-bdec-f0ad4d666b31 Ilie Andriuta created this issue on 07/Oct/26 15:07
 
Summary: PasswordClass related error when login with Admin after an instance upgrade
Issue Type: cid:jira-generated-image-avatar-72eaed6c-8a59-4bce-bc1b-67491537abd0 Bug
Affects Versions: 18.4.6
Assignee: Unassigned
Components: Old Core
Created: 07/Oct/26 15:07
Environment: Windows 11 Pro, Firefox 157, using an instance of XWiki 18.4.6 on Oracle 19c, Tomcat 11, and Jetty/HSQL
Labels: regression
Priority: cid:jira-generated-image-static-blocker-54950791-96cb-4952-9a09-26451f259530 Blocker
Reporter: Ilie Andriuta
Description:

Steps to reproduce

  1. Create an older instance of XWiki (I've reproduced with 12.10.11 and 13.4.7)
  2. Upgrade this instance to XWiki 18.4.6 (by copying the "data" folder to the new instance's folder - on Jetty for ex.)
  3. To better reproduce the issue, if already logged in with Admin, start the 18.4.6 instance on a different port (the idea is to login after starting the instance, or just logout and re-login after upgrade)
  4. After the 18.4.6 instance is started, login with Admin
  5. Observe the logs

Expected results

No error are displayed.

Actual results

The following error is displayed:

2026-10-07 15:19:50,456 [http-nio-1115-exec-8 - http://localhost:1115/xwiki/bin/loginsubmit/XWiki/XWikiLogin] ERROR c.x.x.o.c.PasswordClass        - An outdated algorithm [XWikiLegacy] (or an outdated version of it) is used in a PasswordClass property not yet attached to an object
java.lang.Exception
        at com.xpn.xwiki.objects.classes.PasswordClass.warnAboutOutdatedAlgorithm(PasswordClass.java:473)
        at com.xpn.xwiki.objects.classes.PasswordClass.arePasswordsMatching(PasswordClass.java:443)
        at com.xpn.xwiki.objects.BaseCollection.isPasswordValueMatching(BaseCollection.java:684)
        at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkPassword(XWikiAuthServiceImpl.java:450)
        at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.authenticate(XWikiAuthServiceImpl.java:379)
        at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.authenticate(StandardXWikiAuthServiceComponent.java:81)
        at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.authenticate(MyFormAuthenticator.java:292)
        at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:213)
        at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:195)
        at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkAuth(XWikiAuthServiceImpl.java:203)
        at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.checkAuth(StandardXWikiAuthServiceComponent.java:62)
        at com.xpn.xwiki.XWiki.checkAuth(XWiki.java:4413)
        at org.xwiki.security.authorization.internal.XWikiCachingRightService.authenticateUser(XWikiCachingRightService.java:238)
        at org.xwiki.security.authorization.internal.XWikiCachingRightService.checkAccess(XWikiCachingRightService.java:268)
        at com.xpn.xwiki.XWiki.checkAccess(XWiki.java:4436)
        at com.xpn.xwiki.XWiki.prepareDocuments(XWiki.java:6014)
        at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:548)
        at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:339)
        at com.xpn.xwiki.web.LegacyActionServlet.service(LegacyActionServlet.java:111)
        at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:132)
        at com.xpn.xwiki.web.ActionFilter.doFilter(ActionFilter.java:123)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.wysiwyg.filter.ConversionFilter.doFilter(ConversionFilter.java:71)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:59)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.SetHTTPHeaderFilter.doFilter(SetHTTPHeaderFilter.java:66)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.resource.servlet.RoutingFilter.doFilter(RoutingFilter.java:135)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.SavedRequestRestorerFilter.doFilter(SavedRequestRestorerFilter.java:240)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.SafeRedirectFilter.doFilter(SafeRedirectFilter.java:106)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.ResolveRelativeRedirectFilter.doFilter(ResolveRelativeRedirectFilter.java:129)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.SourceURLResolverFilter.doFilter(SourceURLResolverFilter.java:177)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.xwiki.container.servlet.filters.internal.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:120)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:86)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:782)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:71)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:347)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:71)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1307)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:2201)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:74)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:949)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:483)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:74)
        at java.base/java.lang.Thread.run(Thread.java:1474)

The upgrade, however, if being finished. But it seems the error occurs each time the Admin logins.

The issue could be reproduced on Jetty Standalone (with 12.10.11) and on Tomcat 11 (with 13.4.7 on Oracle 19c) and could not be reproduced when upgrading to XWiki 18.4.5.

 
 

3 updates

 
cid:jira-generated-image-avatar-e169111e-86e6-42d5-bdec-f0ad4d666b31 Changes by Ilie Andriuta on 07/Oct/26 15:07
 
Fix Version: 18.4.7
 
cid:jira-generated-image-avatar-5a66bba6-22c2-44b1-8229-0fee76f251d4 Changes by Simon Urli on 07/Oct/26 15:10
 
Assignee: Simon Urli
 
cid:jira-generated-image-avatar-e169111e-86e6-42d5-bdec-f0ad4d666b31 Changes by Ilie Andriuta on 07/Oct/26 15:14
 
Fix Version: 18.9.0-rc-1