CSRF protection on user_oidc login returned the expected token in case of an error

Vulnerability

In versions 1.0.0 to 1.3.0 of the Nextcloud user_oidc OIDC connector, the CSRF protection mechanism improperly exposes the expected state token in error responses. An attacker can capture the token from the first OIDC login request and reuse it in a second request to bypass state validation. [1][2]

Exploitation

The attacker must be able to intercept or observe the network traffic of a legitimate user initiating an OIDC login. By capturing the initial request containing the expected state token, the attacker can craft a second authentication request with the same token, bypassing the CSRF protection. No user interaction beyond the initial login attempt is required.

Impact

Successful exploitation allows an attacker to bypass CSRF protection and potentially authenticate as the victim user via OIDC, leading to unauthorized access to the victim's Nextcloud account. The confidentiality and integrity of user data may be compromised.

Mitigation

The vulnerability is fixed in user_oidc version 1.3.0. Users should upgrade to this version immediately. No known workarounds are available. [1][2]