Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | User Oidc (b70f2c16-4819-5474-a176-38bc88971988) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52512 |
vulnerable | 2026-06-08 06:52:15.333450 |
Nextcloud User OIDC has an open redirection when logging in with User OIDC
LOW (3.3)
user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.
Published: 2024-11-15T17:18:50.519Z
Updated: 2024-11-15T18:24:27.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37886 |
vulnerable | 2026-06-08 06:39:48.186479 |
Nextcloud user_oidc's ID4me does not validate signature or expiration
MEDIUM (5.4)
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.
Published: 2024-06-14T15:45:12.913Z
Updated: 2024-08-02T03:57:40.025Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37312 |
vulnerable | 2026-06-08 06:39:47.125336 |
Nextcloud user_oidc app's ID4me feature is available even when disabled
MEDIUM (6.3)
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
Published: 2024-06-14T14:43:24.137Z
Updated: 2024-08-02T03:50:55.709Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39954 |
vulnerable | 2026-06-08 06:09:38.168008 |
user_oidc app stores client secret unencrypted in database
LOW (3.8)
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Published: 2023-08-10T14:32:27.032Z
Updated: 2024-10-03T15:08:09.372Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39953 |
vulnerable | 2026-06-08 06:09:38.167442 |
Issuer not verified from obtained token in user_oidc
MEDIUM (4.8)
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Published: 2023-08-10T13:55:19.957Z
Updated: 2024-10-03T15:11:48.536Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32074 |
vulnerable | 2026-06-08 06:04:44.880102 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28848 |
vulnerable | 2026-06-08 06:02:36.524329 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.