# CVE-2026-45691: Nextcloud Server 2FA bypass in DAV endpoints via session cookie reuse

Source: https://junglewise.ai/threats/cve-2026-45691-nextcloud-server-2fa-bypass-in-dav-endpoints-via-session-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-45691 · Severity: medium · CVSS 5.9 · Published 2026-06-01

Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw allowed users who had only completed the first step of login (password) to bypass the required second factor (2FA) to access files. This could allow an attacker with a stolen password to read or modify sensitive documents without needing the secondary security code.

Technologies: [Nextcloud Enterprise Server](https://junglewise.ai/threats/technologies/nextcloud-enterprise-server), [Nextcloud Server](https://junglewise.ai/threats/technologies/nextcloud-server). Vendors: [Nextcloud](https://junglewise.ai/threats/vendors/nextcloud).

## Quick answers

**Is CVE-2026-45691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45691 being exploited in the wild.

**How severe is CVE-2026-45691?** Medium severity, with a CVSS score of 5.9, published 1 June 2026.

**Which products and versions are affected?** Nextcloud Enterprise Server 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3; Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3.

**Is there a fix for CVE-2026-45691?** A patch was published on 2026-04-21: Initial pull request to fix session token handling merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45691 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45691?** Check whether you run Nextcloud Enterprise Server or Nextcloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in Nextcloud Server's session handling. A session cookie generated after successful password authentication, but prior to the completion of Two-Factor Authentication (TOTP), can be reused as a Bearer token. This allows an attacker with valid primary credentials to authenticate against DAV endpoints, granting unauthorized read/write access while bypassing mandatory 2FA. The vulnerability is addressed by improving session token handling to prevent the mix-up between application tokens and session IDs. Patches are available in versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, and 29.0.16.16.

## Affected products

- Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
- Nextcloud Nextcloud Enterprise Server 29.0.0 to < 29.0.16.16, 30.0.0 to < 30.0.17.9, 31.0.0 to < 31.0.14.5, 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3

## Timeline

- 2026-04-21: patched: Initial pull request to fix session token handling merged
- 2026-05-13: advisory: GitHub security advisory published
- 2026-06-01: disclosed: CVE published to NVD

## References

- [https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw)
- [https://github.com/nextcloud/server/pull/59758](https://github.com/nextcloud/server/pull/59758)
- [https://hackerone.com/reports/3573399](https://hackerone.com/reports/3573399)

## Related threats

- [Nextcloud federated share endpoint unauthenticated database write](https://junglewise.ai/threats/cve-2026-77167-abusing-the-federated-share-endpoint-an-attacker-can-write)
- [Nextcloud Server authorization bypass in file comments](https://junglewise.ai/threats/cve-2026-45810-nextcloud-server-authorization-bypass-in-file-comments)
- [Nextcloud Server 2FA bypass via session token replay](https://junglewise.ai/threats/cve-2026-45690-nextcloud-server-2fa-bypass-via-session-token-replay)
- [Nextcloud Server hidden public link creation in Teams sharing](https://junglewise.ai/threats/cve-2026-45285-nextcloud-server-hidden-public-link-creation-in-teams-sharing)
- [Nextcloud Server authorization bypass in calendar delegation](https://junglewise.ai/threats/cve-2026-45281-nextcloud-server-authorization-bypass-in-calendar-delegation)