← back
CVE-2026-45156

Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

CVSS 8.1 HIGHEPSS 0.3%CWE-287
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.1EPSS 0.3%KEV nãoPoC públicaNuclei Metasploit Patch
Lifecycle
01 Jun 2026Published on NVD
23 Jun 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →