Medium severity · published Apr 4, 2023
CVE-2023-28848
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UO
User Oidc · Nextcloud
1.0.0 before 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28848
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28848
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f
Patch
https://github.com/nextcloud/user_oidc/pull/580
Third Party Advisory
https://hackerone.com/reports/1878381
More from User Oidc
9.8
CVE-2023-32074
user_oidc app is an OpenID Connect user backend for Nextcloud
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.1
CVE-2023-39954
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform
6.3
CVE-2024-37312
user_oidc app is an OpenID Connect user backend for Nextcloud
6.1
CVE-2026-45278
Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass