Listen to this Post
How the mentioned CVE works:
The vulnerability exists in the Nextcloud Twofactor WebAuthn provider. The application’s API endpoint for deleting a registered WebAuthn device (e.g., a security key) lacks a critical ownership verification check. When a user deletes their own device, the request includes a unique, long random identifier for that specific device. An attacker can target a victim by crafting a DELETE request to this endpoint and attempting to guess this device identifier. The identifier, while long (80-128 characters), is potentially guessable as it may be derived from predictable data or could be brute-forced under certain conditions. If the attacker successfully guesses a victim’s valid device ID, the request is processed, and the victim’s 2FA device is removed from their account without any authorization. This does not grant the attacker access but causes a denial-of-service for the victim, who will be unable to log in until they register a new WebAuthn device, assuming they have a backup method configured.
DailyCVE Form:
Platform: Nextcloud Twofactor_WebAuthn
Version: <1.4.2, <2.4.1
Vulnerability : Improper Access Control
Severity: Medium
Date: 2025-12-05
Prediction: Patched 2025-12-05
What Undercode Say:
Analytics:
grep -r "deleteDevice" /var/www/nextcloud/apps/twofactor_webauthn/
nc -zv ${TARGET_IP} 443
find /path/to/nextcloud -name ".php" -exec grep -l "registrationId" {} \;
How Exploit:
curl -X DELETE 'https://target.nextcloud.cloud/index.php/apps/twofactor_webauthn/settings/devices/[bash]' -H 'OCS-APIRequest: true' -b 'nc_session_id=[bash]'
Protection from this CVE:
Update to version 1.4.2 or 2.4.1.
Impact:
2FA device removal, login denial.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
