A security flaw has been found in the Nextcloud user_oidc application. This issue could allow users who were previously connected through LDAP to still log into Nextcloud using OIDC, even after their accounts had been removed from the LDAP directory. This essentially creates an unintended backdoor, allowing unauthorized access to the platform.<\/p>\n
Product:<\/strong> Nextcloud user_oidc<\/p>\n Published:<\/strong> June 1, 2026<\/p>\n Severity:<\/strong> Medium<\/p>\n Status:<\/strong> Analyzed<\/p>\n This vulnerability affects Nextcloud user_oidc versions from 1.3.6 up to, but not including, 8.4.0. If you are running any version within this range, your Nextcloud instance may be at risk.<\/p>\n This vulnerability has been officially analyzed and confirmed. A fix is available, and users are strongly encouraged to update their installations.<\/p>\n The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 4.6, classifying it as a Medium<\/strong> severity issue. While not critical, it presents a notable risk due to the potential for unauthorized access, especially in environments where user management relies heavily on LDAP synchronization with OIDC.<\/p>\n The good news is that Nextcloud has already addressed this vulnerability. The recommended solution is to update your Nextcloud user_oidc app to version 8.4.0<\/strong> or later. This patch closes the loophole that allowed deleted LDAP users to retain OIDC authentication capabilities.<\/p>\n If an immediate update is not feasible, a temporary workaround is to disable the Nextcloud user_oidc app entirely. However, this may impact functionalities that rely on OIDC authentication, so evaluate this option carefully based on your operational needs.<\/p>\n https:\/\/github.com\/nextcloud\/security-advisories\/security\/advisories\/GHSA-79xf-ffj8-96fm Understanding the Nextcloud user_oidc Authentication Vulnerability A security flaw has been found in the Nextcloud user_oidc application. This issue could allow users who were previously connected through LDAP to still log into Nextcloud using OIDC, even after their accounts had been removed from the LDAP directory. This essentially creates an unintended backdoor, allowing unauthorized access […]<\/p>\n","protected":false},"author":17,"featured_media":2652,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[907,1129,770,789,1128],"class_list":["post-3650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-authentication","tag-ldap","tag-nextcloud","tag-security","tag-user_oidc"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
References<\/h2>\n
\nhttps:\/\/github.com\/nextcloud\/user_oidc\/pull\/1340
\nhttps:\/\/hackerone.com\/reports\/3554696<\/p>\n","protected":false},"excerpt":{"rendered":"