Read the docs
TI-2023-13354 Aliases CVE-2023-28848

CSRF protection on user_oidc login returned the expected token in case of an error

Priority LOW 24CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudsecurity-advisories1.0.0 to before 1.3.01.3.0Patch availableCNA
  • security-advisories Vendornextcloud Affected 1.0.0 to before 1.3.0 Fixed in 1.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*1.0.0 to before 1.3.0Vulnerablenextcloud
  • cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.3.0 Vulnerable ·nextcloud

Remediation

  • Fix · CNA security-advisories (nextcloud) Fixed in 1.3.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28848

References

Patch 1

Advisory 2

  • TI-2023-15378 Nextcloud user_oidc app is missing brute force protection CVSS 3.1CRITICAL 9.8
  • TI-2026-33084 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate CVSS 3.1HIGH 8.8
  • TI-2023-20847 user_oidc app stores client secret unencrypted in database CVSS 3.1HIGH 8.1
  • TI-2024-24824 Nextcloud user_oidc app's ID4me feature is available even when disabled CVSS 3.1MEDIUM 6.3
  • TI-2024-35183 Nextcloud User OIDC has an open redirection when logging in with User OIDC CVSS 3.1MEDIUM 6.1
  • TI-2026-33079 Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences