CVE-2023-32074

CRITICAL 9.8CVE-2023-32074 · Published 25/05/2023 · updated 17/06/2026

In short

CVE-2023-32074 is a CRITICAL (CVSS 9.8) vulnerability affecting user oidc (nextcloud).
Chance of exploitation in the next 30 days (EPSS): 0.85%, higher than 58.3% of all vulnerabilities.
Fix: update to 1.3.2 or later.

Package	Affected versions	Patched versions
user oidc nextcloud	`< 1.3.2`	`1.3.2`

Description

user_oidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in user_oidc app. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.2

References

nextcloud/security-advisories security advisory · Vendor Advisory
nextcloud/user_oidc#615 · Issue Tracking
hackerone.com/reports/1954711 · Permissions Required

More vulnerabilities in user oidc

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

user oidc

nextcloud

< 1.3.2

1.3.2

More vulnerabilities in user oidc

See all →