Approved changes feed: RSS · Atom
cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nextcloud (e5ae4298-6932-564f-a40d-08cebea039a5) |
|---|---|
| Product | User Oidc (b70f2c16-4819-5474-a176-38bc88971988) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-52512 |
vulnerable | 2026-06-03 14:57:29.753462 |
Nextcloud User OIDC has an open redirection when logging in with User OIDC
LOW (3.3)
user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.
Published: 2024-11-15T17:18:50.519Z
Updated: 2024-11-15T18:24:27.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37886 |
vulnerable | 2026-06-03 14:56:07.256224 |
Nextcloud user_oidc's ID4me does not validate signature or expiration
MEDIUM (5.4)
user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.
Published: 2024-06-14T15:45:12.913Z
Updated: 2024-08-02T03:57:40.025Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37312 |
vulnerable | 2026-06-03 14:56:06.296472 |
Nextcloud user_oidc app's ID4me feature is available even when disabled
MEDIUM (6.3)
user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).
Published: 2024-06-14T14:43:24.137Z
Updated: 2024-08-02T03:50:55.709Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39954 |
vulnerable | 2026-06-03 14:52:39.572572 |
user_oidc app stores client secret unencrypted in database
LOW (3.8)
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Published: 2023-08-10T14:32:27.032Z
Updated: 2024-10-03T15:08:09.372Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39953 |
vulnerable | 2026-06-03 14:52:39.572068 |
Issuer not verified from obtained token in user_oidc
MEDIUM (4.8)
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Published: 2023-08-10T13:55:19.957Z
Updated: 2024-10-03T15:11:48.536Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-32074 |
vulnerable | 2026-06-03 14:51:57.496840 |
Nextcloud user_oidc app is missing brute force protection
HIGH (8)
user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2
Published: 2023-05-25T22:59:27.860Z
Updated: 2025-01-16T18:19:01.564Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-28848 |
vulnerable | 2026-06-03 14:51:38.418605 |
CSRF protection on user_oidc login returned the expected token in case of an error
MEDIUM (4.8)
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.
Published: 2023-04-04T12:38:31.201Z
Updated: 2025-02-11T15:34:05.791Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.