CVE-2024-37886: Nextcloud User Oidc

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

user_oidc app is an OpenID Connect user backend for Nextcloud. An attacker could potentially trick the app into accepting a request that is not signed by the correct server. It is recommended that the Nextcloud user_oidc app is upgraded to 1.3.5, 2.0.0, 3.0.0, 4.0.0 or 5.0.0.

Affected products

• Nextcloud User Oidc: before 1.3.5 (fixed in 1.3.5)

Published 2024-06-14. Last modified 2026-06-17.