# CVE-2026-45278: Nextcloud User OIDC open redirect in login flow

Source: https://junglewise.ai/threats/cve-2026-45278-nextcloud-user-oidc-open-redirect-in-login-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-45278 · Severity: low · CVSS 3.3 · Published 2026-06-01

Nextcloud is an open-source collaboration platform for file sharing and communication. A security flaw in its OpenID Connect (OIDC) login component allows attackers to create malicious links that redirect users to external, untrusted websites after they log in. This could be used in phishing campaigns to trick users into visiting fraudulent sites that mimic the legitimate platform to steal further credentials or deliver malware.

Technologies: [Nextcloud User OIDC](https://junglewise.ai/threats/technologies/user-oidc). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2026-45278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45278 being exploited in the wild.

**How severe is CVE-2026-45278?** Low severity, with a CVSS score of 3.3, published 1 June 2026.

**Which products and versions are affected?** Nextcloud User OIDC 6.1.0 to 8.2.1.

**Is there a fix for CVE-2026-45278?** A patch was published on 2025-12-17: Initial pull request to improve redirect URL checks merged. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45278 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-45278?** Check whether you run Nextcloud User OIDC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An open redirect vulnerability (CWE-601) exists in the Nextcloud User OIDC application between versions 6.1.0 and 8.2.1. The flaw is caused by a protocol-relative URL bypass in the login flow's redirect URL validation logic. An attacker can craft a malicious link that, upon successful OIDC authentication by a victim, redirects the browser to an arbitrary external domain. While the CVSS vector indicates local access, this typically refers to the requirement of user interaction (clicking a link) to trigger the redirect. The issue is resolved in version 8.2.2 by improving the checks used to prevent absolute or protocol-relative URLs in the redirect parameter.

## Affected products

- Nextcloud User OIDC app 6.1.0 to 8.2.1

## Timeline

- 2025-12-17: patched: Initial pull request to improve redirect URL checks merged.
- 2026-05-12: advisory: GitHub security advisory published.
- 2026-06-01: disclosed: CVE-2026-45278 published to NVD.

## References

- [https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73)
- [https://github.com/nextcloud/user_oidc/pull/1273](https://github.com/nextcloud/user_oidc/pull/1273)
- [https://hackerone.com/reports/3464925](https://hackerone.com/reports/3464925)

## Related threats

- [Nextcloud User OIDC improper access control for deleted LDAP users](https://junglewise.ai/threats/cve-2026-45284-nextcloud-user-oidc-improper-access-control-for-deleted-ldap)
- [Nextcloud User OIDC authentication bypass via missing signature verification](https://junglewise.ai/threats/cve-2026-45156-nextcloud-user-oidc-authentication-bypass-via-missing-signature)