CVE-2025-47790

Nextcloud Server is a self hosted personal cloud system. Nextcloud Server prior to 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server prior to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9, and 31.0.3 have a bug with session handling. The bug caused skipping the second factor confirmation after a successful login with the username and password when the server was configured with `remember_login_cookie_lifetime` set to `0`, once the session expired on the page to select the second factor and the page is reloaded. Nextcloud Server 29.0.15, 30.0.9, and 31.0.3 and Nextcloud Enterprise Server is upgraded to 26.0.13.15, 27.1.11.15, 28.0.14.6, 29.0.15, 30.0.9 and 31.0.3 contain a patch. As a workaround, set the `remember_login_cookie_lifetime` in config.php to a value other than `0`, e.g. `900`. Beware that this is only a workaround for new sessions created after the configuration change. System administration can delete affected sessions.

• CWE-287

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9h3w-f3h4-qqrhVendor Advisory
• https://github.com/nextcloud/server/pull/51905Issue Tracking
• https://hackerone.com/reports/2729367Permissions Required

Published

May 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-47785Emlog is an open source website building system. In versions…8.8
• CVE-2025-47786Emlog is an open source website building system. Version 2.5…4.8
• CVE-2025-47787Emlog is an open source website building system. Emlog Pro p…9.8
• CVE-2025-47788Atheos is a self-hosted browser-based cloud IDE. Prior to v6…9.4
• CVE-2025-47789Horilla is a free and open source Human Resource Management …6.1
• CVE-2025-4779lunary-ai/lunary versions prior to 1.9.24 are vulnerable to …6.1
• CVE-2025-47791Nextcloud Server is a self hosted personal cloud system. In …5.3
• CVE-2025-47792Nextcloud Desktop is the desktop sync client for Nextcloud. …6.1
• CVE-2025-47793Nextcloud Server is a self hosted personal cloud system, and…6.5
• CVE-2025-47794Nextcloud Server is a self hosted personal cloud system. In …4.3
• CVE-2025-4780A vulnerability was found in PHPGurukul Park Ticketing Manag…9.8
• CVE-2025-47806In GStreamer through 1.26.1, the subparse plugin's parse_sub…5.6