CVE-2023-39953
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The vulnerability in user_oidc, the OIDC backend for Nextcloud, allowed for a man-in-the-middle attack due to missing issuer verification. An attacker could return a corrupted or known token they had access to.
Risk Assessment
The organization may be exposed to session hijacking and unauthorized access to data, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to version 1.3.3 or later to patch this vulnerability. No known workarounds are available.
Original NVD description (English source)
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.