Nextcloud Two-Factor Webauthn vulnerabilities

1 known vulnerability affecting nextcloud/two-factor_webauthn.

Total CVEs

1

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2025-66558MEDIUMCVSS 4.3≥ 1.0.0, < 1.4.2≥ 2.0.0, < 2.4.12025-12-05

CVE-2025-66558 [MEDIUM] CWE-639 CVE-2025-66558: Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2 Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next