Read the docs
TI-2022-18714 Aliases CVE-2022-39339

Cleartext Transmission of Sensitive Information in user_oidc

Priority LOW 20CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are sent in plain text of HTTP without TLS. Any malicious actor with access to monitor user traffic may have been able to compromise account security. This issue has been addressed in in user_oidc v1.2.1. Users are advised to upgrade. Users unable to upgrade may use https to access Nextcloud. Set an HTTPS discovery URL in the provider settings (in Nextcloud OIDC admin settings).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisoriesbefore 1.2.11.2.1Patch availableCNA
  • security-advisories Vendornextcloud Affected before 1.2.1 Fixed in 1.2.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:openid_connect_user_backend:*:*:*:*:*:nextcloud:*:*before 1.2.1Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:openid_connect_user_backend:*:*:*:*:*:nextcloud:*:* Versions before 1.2.1 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 1.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39339

References

Patch 2

Advisory 1

  • TI-2022-18713 Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidc CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences