CVE-2023-39953

Published: Aug 10, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: NVD

Description

user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.

Affected (1)

Products: Nextcloud: User Oidc

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nextcloud User Oidc	From 1.0.0 to 1.3.3

Related CWEs

Incorrect Implementation of Authentication Algorithm

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References (6)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xx3h-v363-q36j

Source: security-advisories@github.com

PatchVendor Advisory

https://github.com/nextcloud/user_oidc/pull/642

Source: security-advisories@github.com

Patch

https://hackerone.com/reports/2021684

Source: security-advisories@github.com

Permissions Required

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xx3h-v363-q36j

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://github.com/nextcloud/user_oidc/pull/642

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://hackerone.com/reports/2021684

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.