CVE-2023-25818 Missing brute force protection on password reset token in Nextcloud Server

Medium 5.3 Published 27 Mar 2023 Updated 19 Feb 2025

Attackers can bypass rate limits to brute force password reset tokens, potentially taking over user accounts on Nextcloud Server.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-25818?

CVE-2023-25818 is a medium-severity vulnerability in Nextcloud Nextcloud Server, published on 27 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Nextcloud server is an open source, personal cloud implementation. In affected versions a malicious user could try to reset the password of another user and then brute force the 62^21 combinations for the password reset token. As of commit `704eb3aa` password reset attempts are now throttled. Note that 62^21 combinations would significant compute resources to brute force. None the less it is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. There are no known workarounds for this vulnerability.

Weakness: CWE-307

Which versions are affected by CVE-2023-25818?

It affects 1 product.

Products include Nextcloud Nextcloud Server.

How do I fix CVE-2023-25818?

No fix has been published for CVE-2023-25818 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-25818 being exploited?

There is no known exploitation of CVE-2023-25818 in the wild and no public exploit code.

All Nextcloud Nextcloud Server vulnerabilities

Sources

Also known as GHSA-v243-x6jc-42mp.