OAuth2 Access Token and App Password Security Vulnerability

Summary

The OAuth2 endpoint of the Nextcloud server was not following RFC6749. The server did not perform required verification of provided data. And the server did not properly rotate and expire access tokens. In case of a compromised OAuth client this could lead to unauthorized access.

After working together with @noumar the issues have been resolved.