CVE-2025-66558
Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the victim. This vulnerability is fixed in 1.4.2 and 2.4.1.
Published:Dec 5, 2025
Last Modified:Dec 9, 2025
EPS:Dec 5, 2025
EPSS Score:0.00026
CVSS Score:3.1
Affected Products
Vendor
Product
Action
Vendor
Nextcloud
Product
Two-factor Webauthn
Nextcloud
Two-factor Webauthn
Vendor
Nextcloud
Product
Twofactor Webauthn
Nextcloud
Twofactor Webauthn
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
No CAPEC recorded yet
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
