CVE-2025-66558
📋 TL;DR
A vulnerability in Nextcloud's Twofactor WebAuthn plugin allows attackers to remove a user's WebAuthn 2FA device by correctly guessing a long random string. This forces the victim to re-register their device on next login, but does not allow authentication as the victim. All Nextcloud instances using vulnerable versions of the Twofactor WebAuthn plugin are affected.
💻 Affected Systems
- Nextcloud Twofactor WebAuthn plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker successfully guesses the random string and removes a user's WebAuthn 2FA device, forcing account lockout until the user can re-register their device, potentially causing service disruption.
Likely Case
Low probability of successful exploitation due to the need to guess an 80-128 character random string, but if successful, user experiences temporary 2FA disruption requiring device re-registration.
If Mitigated
With proper patching, no impact - the vulnerability is eliminated by the ownership check implementation.
🎯 Exploit Status
Exploitation requires correctly guessing an 80-128 character random string, making successful attacks extremely unlikely in practice.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.2 or 2.4.1
Vendor Advisory: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fr8x-mvjg-wf9q
Restart Required: No
Instructions:
1. Update Nextcloud Twofactor WebAuthn plugin to version 1.4.2 or 2.4.1 via Nextcloud app store or manual installation. 2. No restart required - changes take effect immediately.
🔧 Temporary Workarounds
Disable WebAuthn 2FA
allTemporarily disable the WebAuthn Two-Factor Provider until patched
occ twofactor:disable webauthn
🧯 If You Can't Patch
- Monitor for suspicious 2FA device removal attempts in logs
- Implement rate limiting on 2FA management endpoints
🔍 How to Verify
Check if Vulnerable:
Check the installed version of the twofactor_webauthn app in Nextcloud admin settings or via command: occ app:list | grep twofactor_webauthnCheck Version:
occ app:list | grep twofactor_webauthnVerify Fix Applied:
Verify the twofactor_webauthn app version is 1.4.2 or higher (for v1 branch) or 2.4.1 or higher (for v2 branch)📡 Detection & Monitoring
Log Indicators:
- Unexpected 2FA device removal events
- Failed 2FA registration attempts followed by device removal
Network Indicators:
- Unusual patterns of requests to WebAuthn device management endpoints
SIEM Query:
source="nextcloud" AND (event="2fa_device_removed" OR event="webauthn_device_removed")