Lauritz

The issue is related to the improper validation of discovery URLs in the user oidc OpenID Connect user backend for Nextcloud, potentially leading to a stored cross-site scripting attack vector. The impact is limited due to the restrictive Content Security Policy (CSP) applied on this endpoint. This vulnerability has only been shown to be exploitable in the Safari web browser.

The issue concerns the user oidc OpenID Connect user backend for Nextcloud, where sensitive information such as OIDC client credentials and tokens are sent in plain text over HTTP without TLS in versions prior to 1.2.1. This allows any malicious actor with access to monitor user traffic to potentially compromise account security.

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.