Two Factor Webauthn
Monthly
Nextcloud Twofactor WebAuthn before 1.4.2 and 2.4.1 allows an authenticated attacker who knows a victim's high-entropy WebAuthn public key credential ID to remove that victim's registered two-factor authentication device through a missing ownership check, forcing the victim to re-register a device on next login. The attacker cannot authenticate as the victim, and the dominant limiting factor is the 80-128 character random credential ID, which is not normally exposed and makes guessing practically infeasible; the independent assessment considers this a low real-world priority despite the vendor's CVSS 4.3 rating. No public exploit is identified at time of analysis, EPSS is 0.02% (4th percentile), and no CISA KEV entry is present.
Nextcloud Twofactor WebAuthn before 1.4.2 and 2.4.1 allows an authenticated attacker who knows a victim's high-entropy WebAuthn public key credential ID to remove that victim's registered two-factor authentication device through a missing ownership check, forcing the victim to re-register a device on next login. The attacker cannot authenticate as the victim, and the dominant limiting factor is the 80-128 character random credential ID, which is not normally exposed and makes guessing practically infeasible; the independent assessment considers this a low real-world priority despite the vendor's CVSS 4.3 rating. No public exploit is identified at time of analysis, EPSS is 0.02% (4th percentile), and no CISA KEV entry is present.