PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45156 nextcloud CVE debrief

CVE-2026-45156 is a HIGH severity (CVSS 8.1) authentication bypass vulnerability in Nextcloud's User OIDC application. The flaw stems from missing signature verification in the ID4me authentication flow, allowing a malicious ID4me authority to impersonate any user on affected Nextcloud instances. The vulnerability exists in User OIDC versions 0.3.0 through before 3.1.0, 5.0.0 through before 5.1.0, and 6.0.0 through before 6.4.0. The issue was reported through HackerOne and has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. The vulnerability is classified under CWE-287 (Improper Authentication). The NVD entry currently shows a status of Deferred.

Vendor
nextcloud
Product
security-advisories
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-01
Original CVE updated
2026-07-22
Advisory published
2026-06-01
Advisory updated
2026-07-22

Who should care

Organizations running Nextcloud with User OIDC enabled for ID4me authentication, particularly multi-tenant or externally-facing instances where users may authenticate through federated identity providers.

Technical summary

The Nextcloud User OIDC application fails to verify cryptographic signatures on ID4me authority responses. An attacker who controls or compromises an ID4me authority can forge authentication responses that identify as arbitrary users, achieving complete account takeover without credentials. The vulnerability is network-exploitable with low attack complexity, requires no privileges, and needs only user interaction (redirecting to the malicious authority). Confidentiality and Integrity impacts are HIGH; Availability impact is NONE.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Nextcloud User OIDC to patched versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, or 8.3.0 or later
  • Verify ID4me authority configurations and restrict trusted authorities to known-good endpoints
  • Review authentication logs for anomalous ID4me-based logins prior to patching
  • If immediate patching is not feasible, consider disabling ID4me authentication in User OIDC settings
  • Monitor for updates to the deferred NVD entry for additional technical details

Evidence notes

Vulnerability description and affected versions sourced from official CVE record and GitHub Security Advisory. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. Patch versions confirmed in advisory. HackerOne report reference indicates coordinated disclosure. NVD status is Deferred as of source capture.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45156 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45156

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45156 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45156

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.