CVE-2023-28848: CSRF protection on user_oidc login returned the expected token in case of an error
useroidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade useroidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-28848?
CVE-2023-28848 is a vulnerability in the user_oidc backend for Nextcloud that allows an attacker to bypass state protection.
Which versions of Nextcloud are affected by CVE-2023-28848?
Versions 1.0.0 until 1.3.0 of the user_oidc backend for Nextcloud are affected by CVE-2023-28848.
How severe is CVE-2023-28848?
CVE-2023-28848 has a severity rating of 5.4 (medium).
How can an attacker exploit CVE-2023-28848?
An attacker can exploit CVE-2023-28848 by copying the expected state token from the first request to their second request, effectively bypassing state protection.
Where can I find more information about CVE-2023-28848?
You can find more information about CVE-2023-28848 in the Nextcloud security advisory, the user_oidc pull request on GitHub, and the HackerOne report.