Quick answers
- Is CVE-2026-45156 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45156 being exploited in the wild.
- How severe is CVE-2026-45156?
- High severity, with a CVSS score of 8.1, published 1 June 2026.
- Which products and versions are affected?
- Nextcloud User OIDC 0.3.0 to < 3.1.0, 5.0.0 to < 5.1.0, 6.0.0 to < 6.4.0.
- Is there a fix for CVE-2026-45156?
- A patch was published on 2026-01-12: Pull request to validate ID4me signatures merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45156 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45156?
- Check whether you run Nextcloud User OIDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability exists in the Nextcloud User OIDC application due to missing JWT signature verification during the ID4me login flow. The root cause is the failure to validate the authenticity of identity tokens provided by an ID4me authority. A remote attacker controlling a malicious ID4me authority can exploit this by providing unverified claims, allowing them to identify as and log in as any user on the platform. The vulnerability requires minimal user interaction (initiating a login) and is reachable over the network. Patches are available in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0.
Affected products
- Nextcloud User OIDC 0.3.0 to < 3.1.0, 5.0.0 to < 5.1.0, 6.0.0 to < 6.4.0
Timeline
- 2026-01-12: patched: Pull request to validate ID4me signatures merged
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: NVD publication date