CVE-2023-39953 — Issuer not verified from obtained token in user_oidc
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the …
Published: 2023-08-10 · CVSS: 4.8 · CVSS 3.1
user_oidc provides the OIDC connect user backend for Nextcloud, an open-source cloud platform. Starting in version 1.0.0 and prior to version 1.3.3, missing verification of the issuer would have allowed an attacker to perform a man-in-the-middle attack returning corrupted or known token they also have access to. user_oidc 1.3.3 contains a patch. No known workarounds are available.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7