Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-45284

Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2026-45278

Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2026-45156

Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2024-52512

Nextcloud User OIDC has an open redirection when logging in with User OIDC

user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2024-37312

Nextcloud user_oidc app's ID4me feature is available even when disabled

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register an account eventually getting access to data that is available to all registered users. It is recommended that the OpenID Connect user backend is upgraded to 3.0.0 (Nextcloud 20-23), 4.0.0 (Nexcloud 24) or 5.0.0 (Nextcloud 25-28).

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2024-37886

Nextcloud user_oidc's ID4me does not validate signature or expiration

user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
Nextcloud User Oidc
CVE-2023-28848

CSRF protection on user_oidc login returned the expected token in case of an error

user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2023-32074

Nextcloud user_oidc app is missing brute force protection

user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2023-39954

user_oidc app stores client secret unencrypted in database

user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, an attacker that obtained at least read access to a snapshot of the database can impersonate the Nextcloud server towards linked servers. user_oidc 1.3.3 contains a patch. No known workarounds are available.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc
CVE-2023-39953

Issuer not verified from obtained token in user_oidc

user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nextcloud
Products
User Oidc