CVE-2025-66558CWE-639

CVE-2025-66558

Low · published December 5, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the victim. This vulnerability is fixed in 1.4.2 and 2.4.1.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-05T23:15Z
Affected products (2)
ProductVersionsFixed in
nextcloud/two-factor_webauthn≥ 1.0.0, < 1.4.21.4.2
nextcloud/two-factor_webauthn≥ 2.0.0, < 2.4.12.4.1
References (4)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fr8x-mvjg-wf9q · [email protected]https://github.com/nextcloud/twofactor_webauthn/commit/5d2302166d31ee2e01b2e21556bd5372156da13d · [email protected]https://github.com/nextcloud/twofactor_webauthn/pull/881 · [email protected]https://hackerone.com/reports/3360354 · [email protected]
EPSS history
Timeline
  • 05 DEC 18:00Z
    Nextcloud Twofactor WebAuthn app was updated based on public key
    cvelistv5