Product by Nextcloud
User Oidc
9 known vulnerabilities in User Oidc (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-32074 | Nextcloud user_oidc app is missing brute force protection | 8.0 | |
| Medium | CVE-2024-37312 | Nextcloud user_oidc app's ID4me feature is available even when disabled | 6.3 | |
| Medium | CVE-2023-39953 | Issuer not verified from obtained token in user_oidc | 4.8 | |
| High | CVE-2026-45284 | Nextcloud Security-advisories: Improper Access Control | 4.6 | |
| Medium | CVE-2026-45278 | Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass | 3.3 | |
| Medium | CVE-2024-52512 | Nextcloud User OIDC has an open redirection when logging in with User OIDC | 3.3 | |
| Medium | CVE-2024-37886 | Nextcloud user_oidc's ID4me does not validate signature or expiration | 5.4 | |
| High | CVE-2023-39954 | user_oidc app stores client secret unencrypted in database | 3.8 | |
| Medium | CVE-2023-28848 | CSRF protection on user_oidc login returned the expected token in case of an error | 4.8 |