Is CVE-2026-45690 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45690 being exploited in the wild.

How severe is CVE-2026-45690?

Medium severity, with a CVSS score of 5.9, published 1 June 2026.

Which products and versions are affected?

Nextcloud Enterprise Server 29.0.0 to before 29.0.16.16, 30.0.0 to before 30.0.17.9, 31.0.0 to before 31.0.14.5, 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3; Nextcloud Server 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3.

Is there a fix for CVE-2026-45690?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45690 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45690?

Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45690: Nextcloud Server 2FA bypass via session token replay

CVE-2026-45690 · Severity: medium · CVSS 5.9 · Published 2026-06-01

Nextcloud is a content collaboration platform used by organizations to store and share files. A security flaw allowed attackers who already knew a user's password to bypass two-factor authentication (2FA) protections. By exploiting a temporary session token created during the login process, an attacker could gain full access to the user's account without needing the second security factor.

Technologies: Nextcloud Enterprise Server, Nextcloud Server. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45690 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45690 being exploited in the wild.
How severe is CVE-2026-45690?: Medium severity, with a CVSS score of 5.9, published 1 June 2026.
Which products and versions are affected?: Nextcloud Enterprise Server 29.0.0 to before 29.0.16.16, 30.0.0 to before 30.0.17.9, 31.0.0 to before 31.0.14.5, 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3; Nextcloud Server 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3.
Is there a fix for CVE-2026-45690?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45690 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45690?: Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability exists in Nextcloud Server's 2FA implementation (CWE-287). When a user provides valid primary credentials, the system generates a temporary session token before the second-factor challenge is completed. An attacker with knowledge of the user's password can extract this pending session token and replay it using HTTP Basic Authentication to access authenticated API endpoints, effectively circumventing 2FA. The vulnerability is patched in Nextcloud Server versions 32.0.9 and 33.0.3, and various Enterprise Server maintenance releases.

Affected products

Nextcloud Nextcloud Server 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3
Nextcloud Nextcloud Enterprise Server 29.0.0 to before 29.0.16.16, 30.0.0 to before 30.0.17.9, 31.0.0 to before 31.0.14.5, 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3

Timeline

2026-04-21: other: Fix pull request submitted
2026-05-15: advisory: Vendor security advisory published (GHSA-jgcj-v42r-9922)
2026-06-01: disclosed: CVE-2026-45690 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.