Vulnerability Database

314,496

Total vulnerabilities in the database

CVE-2025-66558

Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would then be prompted to register a new device on the next login. The attacker can not authenticate as the victim. This vulnerability is fixed in 1.4.2 and 2.4.1.

  • Published: Dec 5, 2025
  • Updated: Dec 6, 2025
  • CVE: CVE-2025-66558
  • Severity: Low
  • Exploit:

CVSS v3:

  • Severity: Low
  • Score: 3.1
  • AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
nextcloud / two-factor_webauthn 1.0.0 1.4.2
nextcloud / two-factor_webauthn 2.0.0 2.4.1