An attacker can create specially crafted URLs that cause a user logging in via the user_oidc flow to be redirected to an arbitrary website. This leads to an open redirect condition, allowing phishing or social engineering attacks but no execution or data tampering. The weakness is classified as CWE-601.

The affected product is Nextcloud, an open source content collaboration platform, for all releases from 6.1.0 up to, but not including, 8.2.2. The vulnerability resides in the user_oidc component that handles OpenID Connect authentication.

The CVSS score of 3.3 marks this issue as low severity. The EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The attack vector is inferred to be social engineering: an attacker sends a victim a malicious link that triggers the redirect during login.