Nextcloud's User OIDC component in affected versions lacks proper signature verification, which allows a malicious ID4me authority to authenticate as any user. This improper authentication vulnerability (CWE-287) can lead to unauthorized access with high confidentiality and integrity impact. The vulnerability affects multiple version ranges and has been addressed by patches in later versions (3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact.

Successful exploitation allows a malicious ID4me authority to impersonate any user, potentially leading to unauthorized access to sensitive data and actions within Nextcloud. The confidentiality and integrity of user data are at high risk, while availability is not impacted. No known active exploitation has been reported.

A fix is available in Nextcloud versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. Users running affected versions should upgrade to one of these patched versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on user action to update their installations. Patch status is confirmed by the vendor advisory information embedded in the description.