CVE-2021-32800

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 20.0.12 Nextcloud Server versions prior to 21.0.4 Nextcloud Server versions prior to 22.1.0

Description The issue affects Nextcloud server, an open-source, self-hosted personal cloud. An attacker can bypass Two Factor Authentication in Nextcloud, allowing access to an account with knowledge of a password or access to a WebAuthN trusted device of a user.

Recommendations For versions prior to 20.0.12, upgrade to 20.0.12. For versions prior to 21.0.4, upgrade to 21.0.4. For versions prior to 22.1.0, upgrade to 22.1.0. As a temporary workaround, consider disabling Two Factor Authentication until a patch is available. However, since there are no workarounds for this vulnerability, upgrading to the recommended version is the only solution.