CVE-2026-45691: Nextcloud Server 2FA bypass in DAV endpoints via session cookie reuse

CVE-2026-45691 · Severity: medium · CVSS 5.9 · Published 2026-06-01

Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw allowed users who had only completed the first step of login (password) to bypass the required second factor (2FA) to access files. This could allow an attacker with a stolen password to read or modify sensitive documents without needing the secondary security code.

Technologies: Nextcloud Enterprise Server, Nextcloud Server. Vendors: Nextcloud.

Quick answers

Is CVE-2026-45691 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45691 being exploited in the wild.
How severe is CVE-2026-45691?
Medium severity, with a CVSS score of 5.9, published 1 June 2026.
Which products and versions are affected?
Nextcloud Enterprise Server 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3; Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3.
Is there a fix for CVE-2026-45691?
A patch was published on 2026-04-21: Initial pull request to fix session token handling merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45691 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45691?
Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability (CWE-287) exists in Nextcloud Server's session handling. A session cookie generated after successful password authentication, but prior to the completion of Two-Factor Authentication (TOTP), can be reused as a Bearer token. This allows an attacker with valid primary credentials to authenticate against DAV endpoints, granting unauthorized read/write access while bypassing mandatory 2FA. The vulnerability is addressed by improving session token handling to prevent the mix-up between application tokens and session IDs. Patches are available in versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, and 29.0.16.16.

Affected products

  • Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
  • Nextcloud Nextcloud Enterprise Server 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3

Timeline

  • 2026-04-21: patched: Initial pull request to fix session token handling merged
  • 2026-05-13: advisory: GitHub security advisory published
  • 2026-06-01: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.