Medium severity4.8NVD Advisory· Published Apr 4, 2023· Updated Jun 17, 2026
CVE-2023-28848
CVE-2023-28848
Description
user_oidc is the OIDC connect user backend for Nextcloud, an open source collaboration platform. A vulnerability in versions 1.0.0 until 1.3.0 effectively allowed an attacker to bypass the state protection as they could just copy the expected state token from the first request to their second request. Users should upgrade user_oidc to 1.3.0 to receive a patch for the issue. No known workarounds are available.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- nextcloud/security-advisoriesv5Range: >= 1.0.0, < 1.3.0
Patches
Vulnerability mechanics
References
3- github.com/nextcloud/user_oidc/pull/580nvdPatchVendor Advisory
- github.com/nextcloud/security-advisories/security/advisories/GHSA-52hv-xw32-wf7fnvdVendor Advisory
- hackerone.com/reports/1878381nvdThird Party Advisory
News mentions
0No linked articles in our index yet.