PT-2026-45534 · Nextcloud · Nextcloud Server+1

Dorra Jaouad + 1 · CVE-2026-45690 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.8 Nextcloud Server versions 33.0.0 through 33.0.2 Nextcloud Enterprise Server (affected versions not specified)

Description An authentication bypass allows attackers who possess a user's password to circumvent two-factor authentication (2FA) protections. During the login process for a 2FA-enabled account, the system generates a temporary session token before the second factor challenge is enforced. This token can be extracted and replayed using HTTP Basic Authentication to gain unauthorized access to authenticated endpoints.

Recommendations Upgrade Nextcloud Server versions 32.0.0 through 32.0.8 to 32.0.9. Upgrade Nextcloud Server versions 33.0.0 through 33.0.2 to 33.0.3. Upgrade Nextcloud Enterprise Server to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-NEXTCLOUD-2026-45690

CVE-2026-45690

GHSA-JGCJ-V42R-9922

Affected Products

Nextcloud Enterprise Server

Nextcloud Server

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45690.json · Exploit
• https://github.com/nextcloud/server/pull/59758 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45690 · Security Note
• https://osv.dev/vulnerability/BIT-nextcloud-2026-45690 · Vendor Advisory
• https://t.me/cveNotify/211622 · Telegram Post
• https://hackerone.com/reports/3639301 · Note
• https://twitter.com/threatcluster/status/2067291586774323342 · Twitter Post