PT-2025-21656 · Nextcloud · Nextcloud Server+1

Nickvergessen

·

Published

2025-05-16

·

Updated

2025-09-30

·

CVE-2025-47790

CVSS v3.1

6.4

Medium

VectorAV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 29.0.15, 30.0.9, and 31.0.3 Nextcloud Enterprise Server versions prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3
Description: The issue concerns a bug in session handling. When the server is configured with remember login cookie lifetime set to 0, the second factor confirmation is skipped after a successful login with the username and password, once the session expires on the page to select the second factor and the page is reloaded.
Recommendations: For Nextcloud Server versions prior to 29.0.15, 30.0.9, and 31.0.3, update to version 29.0.15, 30.0.9, or 31.0.3. For Nextcloud Enterprise Server versions prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3, update to version 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, or 31.0.3. As a temporary workaround, set the remember login cookie lifetime in config.php to a value other than 0, e.g. 900. System administration can delete affected sessions.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-47790
GHSA-9H3W-F3H4-QQRH

Affected Products

Nextcloud Enterprise Server
Nextcloud Server