CVE-2026-45156
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.1EPSS 0.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
01 Jun 2026Published on NVD
23 Jun 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected products
nextcloud · security-advisoriespublic PoCs found — 1
githubgithub.com/cybertechajju/CVE-2026-45156-POC★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →