# CVE-2026-84473: ownCloud server authentication bypass in WebDAV endpoint

Source: https://junglewise.ai/threats/cve-2026-84473-authentication-bypass-missing-brute-force-protection-in-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-84473 · Severity: info · Published 2026-11-06

ownCloud server is a file-sharing and collaboration platform used by organizations to store and sync documents. The WebDAV endpoint that provides file access over HTTP lacks brute-force protection, allowing attackers to guess user passwords repeatedly without encountering delays or account lockouts. An attacker exploiting this could gain unauthorized access to sensitive files and folders stored in compromised accounts.

Vendors: [ownCloud](https://junglewise.ai/threats/vendors/owncloud).

## Quick answers

**Is CVE-2026-84473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84473 being exploited in the wild.

**How severe is CVE-2026-84473?** Informational severity, published 6 November 2026.

**Which products and versions are affected?** ownCloud server 10.16.3.

**Is there a fix for CVE-2026-84473?** No fixed version is recorded yet. Implement brute-force protection across all authentication mechanisms including HTTP Basic Authentication on the WebDAV endpoint. Recommended controls include tracking failed authentication attempts per account or source, applying progressive delays or temporary lockouts after a configurable threshold (such as 10 consecutive failures), and returning HTTP 429 responses when rate limits are triggered. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84473 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84473?** Check whether you run ownCloud server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Implement brute-force protection across all authentication mechanisms including HTTP Basic Authentication on the WebDAV endpoint. Recommended controls include tracking failed authentication attempts per account or source, applying progressive delays or temporary lockouts after a configurable threshold (such as 10 consecutive failures), and returning HTTP 429 responses when rate limits are triggered.

## Technical details

The remote.php/webdav/ endpoint accepts HTTP Basic Authentication credentials without implementing rate limiting, progressive delays, or account lockout after multiple failed attempts. An unauthenticated remote attacker can submit unlimited password-guessing requests via repeated Authorization headers and still successfully authenticate once the correct password is found. The vulnerability exists because brute-force protections are not applied consistently across all authentication mechanisms in the application.

## Affected products

- ownCloud ownCloud server 10.16.3

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/KOBUKOVUI/CVE-2026-84473](https://github.com/KOBUKOVUI/CVE-2026-84473)