A missing signature verification in the User OIDC implementation of Nextcloud allowed an attacker who controls an ID4me authority to forge a JSON Web Token that identifies as any user. Because the token is accepted without verification, the attacker can impersonate legitimate users, gaining access to files, settings, and collaboration spaces. The flaw is classified as CWE-287, a failure of authentication causing a serious breach of confidentiality and integrity.

The vulnerability affects Nextcloud versions 0.3.0 through before 3.1.0, 5.0.0 through before 5.1.0, and 6.0.0 through before 6.4.0. The issue was fixed in releases 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. All installations using the affected ranges that enable the User OIDC (ID4me) feature are at risk.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is not available, so exploitation probability cannot be quantified, but the flaw can be leveraged by any entity that can set up a malicious ID4me authority, which may be a realistic threat. The vulnerability is not listed in CISA KEV, but the impact of impersonation makes it a critical concern for organizations relying on Nextcloud for secure collaboration.