Read the docs
TI-2022-18713 Aliases CVE-2022-39338

Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc

Priority LOW 25CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross site scripting attack vector. The impact is limited due to the restrictive CSP that is applied on this endpoint. Additionally this vulnerability has only been shown to be exploitable in the Safari web browser. This issue has been addressed in version 1.2.1. Users are advised to upgrade. Users unable to upgrade should urge their users to avoid using the Safari web browser.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00655 51st percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 1.2.11.2.1Patch availableCNA
  • security-advisories Vendornextcloud Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:openid_connect_user_backend:*:*:*:*:*:nextcloud:*:*before 1.2.1Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:openid_connect_user_backend:*:*:*:*:*:nextcloud:*:* Versions before 1.2.1 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 1.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39338
  2. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

  • TI-2022-18714 Cleartext Transmission of Sensitive Information in user_oidc CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences