CVE-2025-66558 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) affecting the Nextcloud Twofactor WebAuthn provider. This component implements WebAuthn-based two-factor authentication for Nextcloud, a widely used open-source collaboration platform. The vulnerability exists in versions prior to 1.4.2 and between 2.0.0-beta.1 and before 2.4.1 due to a missing ownership verification when handling WebAuthn device keys. Specifically, an attacker who can guess the victim's 2FA device key—a random string between 80 and 128 characters composed of letters, numbers, and symbols—can take over the victim’s registered 2FA device. This takeover does not allow the attacker to authenticate as the victim but causes the victim to be prompted to register a new 2FA device upon their next login, effectively disrupting the 2FA mechanism. The attack vector is network-based, requires the attacker to have low privileges (likely a registered user), and has high attack complexity due to the difficulty in guessing the long random key. No user interaction is required, and the scope is unchanged since the attacker cannot escalate privileges or access victim data directly. The vulnerability has a CVSS v3.1 base score of 3.1, indicating low severity, with no known exploits in the wild. The issue is resolved in Nextcloud Twofactor WebAuthn versions 1.4.2 and 2.4.1.

For European organizations, the impact of this vulnerability is primarily operational and related to the integrity of two-factor authentication processes. While the attacker cannot directly access or impersonate the victim, the ability to take over a 2FA device registration can cause denial of service to legitimate users by forcing them to re-register their 2FA devices. This disruption can lead to temporary loss of access, increased helpdesk workload, and potential user frustration. In environments with strict security policies or regulatory requirements (such as GDPR), any weakening or disruption of authentication mechanisms can raise compliance concerns. Organizations relying heavily on Nextcloud for collaboration and sensitive data sharing may face increased risk if attackers exploit this flaw to undermine trust in authentication controls. However, since confidentiality and availability are not directly compromised, and no known exploits exist, the overall risk remains low but non-negligible. The vulnerability could be leveraged as part of a broader attack chain if combined with other weaknesses.

European organizations should immediately verify their Nextcloud Twofactor WebAuthn versions and upgrade to 1.4.2 or 2.4.1 or later to remediate this vulnerability. Beyond patching, organizations should enforce strong random generation and protection of 2FA device keys to prevent guessing attacks. Monitoring authentication logs for unusual 2FA device re-registrations can help detect exploitation attempts. Implementing network segmentation and limiting access to Nextcloud administrative interfaces reduces exposure. Additionally, educating users about unexpected 2FA prompts and establishing rapid incident response procedures for authentication anomalies will mitigate operational impacts. Organizations should also consider multi-layered authentication strategies and continuous security assessments of their 2FA implementations. Finally, maintaining up-to-date backups and recovery plans ensures resilience against potential disruptions caused by such vulnerabilities.