6.4

CVE-2025-47790: nextcloud nextcloud_server Improper Authentication

CVSS: 6.4v3.1MediumAnalyzed
Published 16-05-2025Last modified 16-05-2025
Open JSON

Vulnerability summary

CVE-2025-47790 is a medium (CVSS 6.4) Improper Authentication vulnerability in nextcloud nextcloud_server. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.8% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 16-05-2025
    PublishedVulnerability first disclosed.
  2. 16-05-2025
    Last modifiedVulnerability information updated.

Description

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

+0.02 pp

From 0.38% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Nextcloud2 products
  • nextcloud_server≥ 26.0.0, < 26.0.13.15 | ≥ 27.0.0, < 27.1.11.15 | ≥ 28.0.0, < 28.0.14.6 | ≥ 29.0.0, < 29.0.15 | ≥ 30.0.0, < 30.0.9 | ≥ 31.0.0, < 31.0.3
  • security-advisories≥ 26.0.0, < 26.0.13.15 | ≥ 27.0.0, < 27.1.11.15 | ≥ 28.0.0, < 28.0.14.6 | ≥ 29.0.0, < 29.0.15 | ≥ 30.0.0, < 30.0.9 | ≥ 31.0.0, < 31.0.3

1 vendor · 2 products

References

3 links