Nextcloud · Report #1954711
user_oidc app is missing bruteforce protection
Validstatus
mediumseverity
4upvotes
23 Jun 2023disclosed
Summary
SA: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x8mc-84wj-rf34
How it was found
Summary:
Various controllers of the user_oidc app are not bruteforce protected, allowing attackers to iterate over data until they find valid one.
- Id4meController::login
- Id4meController::code
- LoginController::login
- LoginController::code
- LoginController::csingleLogoutService
- LoginController::cbackChannelLogout
Impact
Authentication can be broken/bypassed