Executive brief
Nextcloud is a content collaboration platform used by organizations to store and share files. A security flaw allowed attackers who already knew a user's password to bypass two-factor authentication (2FA) protections. By exploiting a temporary session token created during the login process, an attacker could gain full access to the user's account without needing the second security factor.
Technical details
An authentication bypass vulnerability exists in Nextcloud Server's 2FA implementation (CWE-287). When a user provides valid primary credentials, the system generates a temporary session token before the second-factor challenge is completed. An attacker with knowledge of the user's password can extract this pending session token and replay it using HTTP Basic Authentication to access authenticated API endpoints, effectively circumventing 2FA. The vulnerability is patched in Nextcloud Server versions 32.0.9 and 33.0.3, and various Enterprise Server maintenance releases.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3
- Nextcloud Nextcloud Enterprise Server 29.0.0 to before 29.0.16.16, 30.0.0 to before 30.0.17.9, 31.0.0 to before 31.0.14.5, 32.0.0 to before 32.0.9, 33.0.0 to before 33.0.3
Timeline
- 2026-04-21: other: Fix pull request submitted
- 2026-05-15: advisory: Vendor security advisory published (GHSA-jgcj-v42r-9922)
- 2026-06-01: disclosed: CVE-2026-45690 published