CVE-2025-47790 Nextcloud Server doesn't request second factor after session timeout
Attackers can bypass second-factor authentication after session timeout if remember_login_cookie_lifetime is set to zero.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-47790?
CVE-2025-47790 is a medium-severity authentication bypass vulnerability in Nextcloud Nextcloud Server, published on 16 May 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.
Weakness: CWE-287
Which versions are affected by CVE-2025-47790?
It affects 1 product.
Products include Nextcloud Nextcloud Server.
How do I fix CVE-2025-47790?
No fix has been published for CVE-2025-47790 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-47790 being exploited?
There is no known exploitation of CVE-2025-47790 in the wild and no public exploit code.
Other vulnerabilities in Nextcloud Nextcloud Server
- CVE-2021-32802 Preview generation used third-party library not suited for user-generated content in Nextcloud server
- CVE-2023-26482 Scope of workflow operations is not validated in nextcloud server
- CVE-2018-3775 Auth bypass in Nextcloud Server
- CVE-2023-35172 Nextcloud Server password reset endpoint is not brute force protected
- CVE-2023-32320 Nextcloud Server's brute force protection allows someone to send more requests than intended
Sources
Also known as GHSA-9h3w-f3h4-qqrh.