Understanding the Nextcloud user_oidc Authentication Vulnerability
A security flaw has been found in the Nextcloud user_oidc application. This issue could allow users who were previously connected through LDAP to still log into Nextcloud using OIDC, even after their accounts had been removed from the LDAP directory. This essentially creates an unintended backdoor, allowing unauthorized access to the platform.
CVE Details
Product: Nextcloud user_oidc
Published: June 1, 2026
Severity: Medium
Status: Analyzed
Affected Products
This vulnerability affects Nextcloud user_oidc versions from 1.3.6 up to, but not including, 8.4.0. If you are running any version within this range, your Nextcloud instance may be at risk.
Current Status
This vulnerability has been officially analyzed and confirmed. A fix is available, and users are strongly encouraged to update their installations.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 4.6, classifying it as a Medium severity issue. While not critical, it presents a notable risk due to the potential for unauthorized access, especially in environments where user management relies heavily on LDAP synchronization with OIDC.
Possible Solutions
The good news is that Nextcloud has already addressed this vulnerability. The recommended solution is to update your Nextcloud user_oidc app to version 8.4.0 or later. This patch closes the loophole that allowed deleted LDAP users to retain OIDC authentication capabilities.
If an immediate update is not feasible, a temporary workaround is to disable the Nextcloud user_oidc app entirely. However, this may impact functionalities that rely on OIDC authentication, so evaluate this option carefully based on your operational needs.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-79xf-ffj8-96fm
https://github.com/nextcloud/user_oidc/pull/1340
https://hackerone.com/reports/3554696
