Nextcloud / User Oidc
9 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-45284 | Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate | HIGH | 8.8 | Jun 1, 2026 |
| CVE-2026-45278 | Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass | MEDIUM | 6.1 | Jun 1, 2026 |
| CVE-2024-52512 | Nextcloud User OIDC has an open redirection when logging in with User OIDC | MEDIUM | 6.1 | Nov 15, 2024 |
| CVE-2024-37886 | Nextcloud user_oidc's ID4me does not validate signature or expiration | MEDIUM | 5.4 | Jun 14, 2024 |
| CVE-2024-37312 | Nextcloud user_oidc app's ID4me feature is available even when disabled | MEDIUM | 6.3 | Jun 14, 2024 |
| CVE-2023-39954 | user_oidc app stores client secret unencrypted in database | HIGH | 8.1 | Aug 10, 2023 |
| CVE-2023-39953 | Issuer not verified from obtained token in user_oidc | MEDIUM | 4.8 | Aug 10, 2023 |
| CVE-2023-32074 | Nextcloud user_oidc app is missing brute force protection | CRITICAL | 9.8 | May 25, 2023 |
| CVE-2023-28848 | CSRF protection on user_oidc login returned the expected token in case of an error | MEDIUM | 5.4 | Apr 4, 2023 |
Showing 1 to 9 of 9 CVEs