BIT-nextcloud-2026-45153

vendorUSosv

Nextcloud: PIN bypass in PassCodeActivity via back button

view advisory published 2026-07-12Licence: per source

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-45153US	—	0.15% (4th)	—	2026-06-01
Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to by…

references

External citations — patches, advisories, analysis.

https://github.com/nextcloud/android/pull/16896WEB
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2w7v-5299-3hw5WEB
https://hackerone.com/reports/3625210WEB
https://nvd.nist.gov/vuln/detail/CVE-2026-45153WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan