🎯 New Report #3400143: Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
🔺Severity: Medium
👽 Reporter: py0zz1
⭐️ Reputation: 122
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 250
🕐 Submitted: 2025-10-26
⏰ Disclosed: 2026-04-13 16:23:08
📝 Summary: The Nextcloud Desktop Client was found to automatically include user credentials (Authorization header with username and password in Base64) when downloading files via the "directDownloadUrl" feature. This allowed a malicious Nextcloud server to specify an attacker-controlled URL, causing the client to leak the user's credentials to the attacker's server. The root cause was the failure to validate the origin of the "directDownloadUrl" and the lack of setting the "DontAddCredentialsAttribute" for cross-origin requests.
📂 Report JSON File: 3400143
@hackeronereports