What’s Vulnerable › Vulnerabilities

CVE-2023-28848: CSRF protection on user_oidc login returned the expected token in case of an error

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-04 · updated 2026-06-17
• Weakness: CWE-352

Description

user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.

Affected products

• nextcloud User Oidc: from 1.0.0 before 1.3.0 — fixed in 1.3.0

How to fix

Upgrade to a fixed version: nextcloud User Oidc 1.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f
• https://github.com/nextcloud/user_oidc/pull/580
• https://hackerone.com/reports/1878381
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7f
• https://github.com/nextcloud/user_oidc/pull/580
• https://hackerone.com/reports/1878381

Get alerted when CVE-2023-28848 or the next vulnerability affects your stack