What’s Vulnerable › Products

nextcloud User Oidc vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your nextcloud User Oidc version is affected

Latest nextcloud User Oidc vulnerabilities

• CVE-2026-45284 — Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate (CVSS 8.8)
• CVE-2026-45278 — Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass (CVSS 6.1)
• CVE-2024-52512 — Nextcloud User OIDC has an open redirection when logging in with User OIDC (CVSS 6.1)
• CVE-2024-37886 — Nextcloud user_oidc's ID4me does not validate signature or expiration (CVSS 4.7)
• CVE-2024-37312 — Nextcloud user_oidc app's ID4me feature is available even when disabled (CVSS 6.3)
• CVE-2023-39954 — user_oidc app stores client secret unencrypted in database (CVSS 8.1)
• CVE-2023-39953 — Issuer not verified from obtained token in user_oidc (CVSS 4.8)
• CVE-2023-32074 — Nextcloud user_oidc app is missing brute force protection (CVSS 9.8)
• CVE-2023-28848 — CSRF protection on user_oidc login returned the expected token in case of an error (CVSS 5.4)