Vulnerability · Published Dec 5, 2025 · Assigned by GitHub_M

CVE-2025-66558Nextcloud Twofactor WebAuthn app was updated based on public key

Low 3.1

In plain English

A low-severity authorization bypass via user-controlled key in security-advisories from nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the victim. This vulnerability is fixed in 1.4.2 and 2.4.1.

Affected products (as reported)

Vendor	Product	Versions
nextcloud	security-advisories	< 1.4.2>= 2.0.0-beta.1, < 2.4.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fr8x-mvjg-wf9q x_refsource_CONFIRM
https://github.com/nextcloud/twofactor_webauthn/pull/881 x_refsource_MISC
https://github.com/nextcloud/twofactor_webauthn/commit/5d2302166d31ee2e01b2e21556bd5372156da13d x_refsource_MISC
https://hackerone.com/reports/3360354 x_refsource_MISC