PT-2026-45472 · Nextcloud · User Oidc

Cybertechajju · CVE-2026-45156 · Published 2026-01-07 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 0.3.0 through 3.0.x Nextcloud versions 5.0.0 through 5.0.x Nextcloud versions 6.0.0 through 6.3.x

Description A missing signature verification in User OIDC allows a malicious ID4me authority to identify as any user. This occurs due to the lack of JWT (JSON Web Token) signature verification, which is a standard used to securely transmit information between parties as a JSON object.

Recommendations Update versions 0.3.0 through 3.0.x to version 3.1.0. Update versions 5.0.0 through 5.0.x to version 5.1.0. Update versions 6.0.0 through 6.3.x to version 6.4.0.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-08694

CVE-2026-45156

GHSA-QQGV-FQWP-MJPP

Affected Products

User Oidc

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45156.json · Exploit
• 🔥 https://github.com/cybertechajju/CVE-2026-45156-POC · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45156 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45156 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08694 · Security Note
• https://github.com/nextcloud/user_oidc/pull/1285 · Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgv-fqwp-mjpp · Note
• https://t.me/avleonovcom/1665 · Telegram Post
• https://t.me/CVEtracker/55508 · Telegram Post
• https://twitter.com/luckyhacker43/status/2064697671927910597 · Twitter Post
• https://hackerone.com/reports/3489490 · Note