What is the CVSS score of CVE-2025-47790?

CVE-2025-47790 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-47790?

Organizations using Nextcloud Server should be aware of moderate risk from CVE-2025-47790, a improper authentication vulnerability rated CVSS 6.4.

How to fix or mitigate CVE-2025-47790?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

PHP CVE-2025-47790

MEDIUM

Improper Authentication (CWE-287)

2025-05-16 security-advisories@github.com

PHP Authentication Bypass Nextcloud Server Nextcloud

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:42 vuln.today

CVE Published

May 16, 2025 - 14:15 nvd

MEDIUM 6.4

DescriptionGitHub Advisory

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with remember_login_cookie_lifetime set to 0, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the remember_login_cookie_lifetime in config.php to a value other than 0, e.g. 900. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

AnalysisAI

Nextcloud Server is a self hosted personal cloud system. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with remember_login_cookie_lifetime set to 0, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the remember_login_cookie_lifetime in config.php to a value other than 0, e.g. 900. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions. Affected products include: Nextcloud Nextcloud Server. Version information: prior to 29.0.15.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.