CVE-2024-37886: Nextcloud user_oidc's ID4me does not validate signature or expiration
useroidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud useroidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37886?
The severity of CVE-2024-37886 has not been explicitly rated but involves a potential security risk in the Nextcloud user_oidc app.
How do I fix CVE-2024-37886?
To fix CVE-2024-37886, upgrade the Nextcloud user_oidc app to version 1.3.5, 2.0.0, 3.0.0, 4.0.0, or 5.0.0.
Which versions of the Nextcloud user_oidc app are affected by CVE-2024-37886?
Versions of the Nextcloud user_oidc app below 1.3.5 and between 1.3.5 and 5.0.0 are affected by CVE-2024-37886.
What type of attack does CVE-2024-37886 allow?
CVE-2024-37886 allows an attacker to potentially trick the Nextcloud user_oidc app into accepting an unsigned request.
Who is the vendor for CVE-2024-37886?
The vendor for CVE-2024-37886 is Nextcloud, which develops the user_oidc app.