Nextcloud OIDC Connect user_oidc OID issuer verification flaw v1.0.0-1.3.2
CVE-2023-39953 Published on August 10, 2023
Issuer not verified from obtained token in user_oidc
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Vulnerability Analysis
CVE-2023-39953 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Incorrect Implementation of Authentication Algorithm
The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. This incorrect implementation may allow authentication to be bypassed.
Products Associated with CVE-2023-39953
Want to know whenever a new CVE is published for Nextcloud User Oidc? stack.watch will email you.
Affected Versions
nextcloud security-advisories Version >= 1.0.0, < 1.3.3 is affected by CVE-2023-39953Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.