Executive brief
Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw allowed users who had only completed the first step of login (password) to bypass the required second factor (2FA) to access files. This could allow an attacker with a stolen password to read or modify sensitive documents without needing the secondary security code.
Technical details
An improper authentication vulnerability (CWE-287) exists in Nextcloud Server's session handling. A session cookie generated after successful password authentication, but prior to the completion of Two-Factor Authentication (TOTP), can be reused as a Bearer token. This allows an attacker with valid primary credentials to authenticate against DAV endpoints, granting unauthorized read/write access while bypassing mandatory 2FA. The vulnerability is addressed by improving session token handling to prevent the mix-up between application tokens and session IDs. Patches are available in versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, and 29.0.16.16.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
- Nextcloud Nextcloud Enterprise Server 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
Timeline
- 2026-04-21: patched: Initial pull request to fix session token handling merged
- 2026-05-13: advisory: GitHub security advisory published
- 2026-06-01: disclosed: CVE published to NVD