PT-2024-27811 · Nextcloud · Nextcloud User Oidc

Mikaelgundersen · Published 2024-06-14 · Updated 2025-08-14 · CVE-2024-37886

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud user oidc app versions prior to 1.3.5 Nextcloud user oidc app versions prior to 2.0.0 Nextcloud user oidc app versions prior to 3.0.0 Nextcloud user oidc app versions prior to 4.0.0 Nextcloud user oidc app versions prior to 5.0.0

Description The user oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server.

Recommendations For versions prior to 1.3.5, upgrade to version 1.3.5 or later. For versions prior to 2.0.0, upgrade to version 2.0.0 or later. For versions prior to 3.0.0, upgrade to version 3.0.0 or later. For versions prior to 4.0.0, upgrade to version 4.0.0 or later. For versions prior to 5.0.0, upgrade to version 5.0.0 or later.

Exploit

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2024-37886

GHSA-VW5H-29XF-G55G

Affected Products

Nextcloud User Oidc

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37886.json · Exploit
• https://github.com/nextcloud/user_oidc/pull/715 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vw5h-29xf-g55g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37886 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37886 · Vendor Advisory
• https://twitter.com/CVEnew/status/1801673781557215560 · Twitter Post
• https://t.me/cveNotify/132331 · Telegram Post
• https://hackerone.com/reports/1878391 · Note