PT-2026-45523 · Nextcloud · Nextcloud

Julien Veyssier + 1 · Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-45278

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud versions 6.1.0 through 8.2.1

Description An attacker can craft malicious links that redirect users to an external website when the victim attempts to log in using OpenID Connect (OIDC), a protocol used for authentication.

Recommendations Update to version 8.2.2.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-45278

Affected Products

Nextcloud

References · 5

• https://github.com/nextcloud/user_oidc/pull/1273 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45278 · Security Note
• https://hackerone.com/reports/3464925 · Note
• https://t.me/cveNotify/165646 · Telegram Post