CVE-2026-45691
mediumpriority · track · 0EPSS 0.003 · 21 %ileDEEUUSEPSS · scored 2026-10-27
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (23)
Products and version ranges known to be affected.
- nextcloud nextcloud server29.0.0 → 29.0.16.16nvdUScpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
- nextcloud nextcloud server30.0.0 → 30.0.17.9nvdUScpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
- nextcloud nextcloud server31.0.0 → 31.0.14.5nvdUScpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1517Nextcloud: Mehrere SchwachstellenDeutsch2026-05-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Nextcloud ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um einen SQL-Injection Angriff durchzuführen.
- BIT-nextcloud-2026-45691Nextcloud: Bypass of second factor authentication on DAV endpoints2026-07-12vendor · osvUS
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-45691cnnvd
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jwcnnvd
- https://github.com/nextcloud/server/pull/59758cnnvd
- https://github.com/nextcloud/server/releasesPatchcnnvd
- https://hackerone.com/reports/3573399cnnvd
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jwenisa_euvd
- https://github.com/nextcloud/server/pull/59758enisa_euvd
- https://hackerone.com/reports/3573399enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan