PT-2025-49302 · Nextcloud · Nextcloud Twofactor Webauthn

Published 2025-12-05 · Updated 2025-12-09 · CVE-2025-66558

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Twofactor WebAuthn versions prior to 1.4.2 Nextcloud Twofactor WebAuthn versions prior to 2.4.1

Description A missing ownership check allows an attacker to remove a user's WebAuthn two-factor authentication device by correctly guessing a random string of 80-128 characters. This action prompts the victim to register a new device upon their next login. The attacker cannot authenticate as the victim.

Recommendations Update to Nextcloud Twofactor WebAuthn version 1.4.2 or later. Update to Nextcloud Twofactor WebAuthn version 2.4.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-66558

GHSA-FR8X-MVJG-WF9Q

Affected Products

Nextcloud Twofactor Webauthn

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66558.json · Exploit
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fr8x-mvjg-wf9q · Vendor Advisory
• https://github.com/nextcloud/twofactor_webauthn/pull/881 · Patch
• https://github.com/nextcloud/twofactor_webauthn/commit/5d2302166d31ee2e01b2e21556bd5372156da13d · Patch
• https://hackerone.com/reports/3360354 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66558 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66558 · Security Note
• https://t.me/cveNotify/145229 · Telegram Post
• https://twitter.com/CVEnew/status/1997016164988314013 · Twitter Post
• https://t.me/CVEtracker/38954 · Telegram Post
• https://twitter.com/dailycve/status/1998491526595530968 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997117519052566789 · Twitter Post