Nextcloud is a popular open-source platform for file hosting and collaboration, widely used for secure data synchronization and sharing. A security flaw has recently been identified in its “User OIDC” application. This vulnerability, known as an Open Redirect, could potentially allow an attacker to trick users into visiting unintended or malicious websites.
This situation arises when a user clicks on a specially crafted link provided by an attacker. If the victim then proceeds to log in via OpenID Connect (OIDC) using that link, they could be redirected to a different website than expected. While rated as “Low” severity, addressing such issues promptly is always a critical step in maintaining a robust and secure digital environment for all users.
CVE Details
- Product Name: Nextcloud User OIDC
- Published Date: June 01, 2026
- Severity: Low
- Status: Analyzed
Affected Products
The Nextcloud User OIDC application is susceptible to this vulnerability across versions starting from 6.1.0 up to, but not including, version 8.2.2. This includes versions such as 6.3.0 within this range. If your Nextcloud instance utilizes the User OIDC app and falls within these affected versions, it is imperative to take corrective action to secure your system.
Current Status
The vulnerability, tracked under the identifier CVE-2026-45278, has undergone thorough analysis. This means that security researchers and Nextcloud developers fully understand the nature of the flaw, its potential impact, and have successfully developed and released the necessary solutions to mitigate the risk.
Severity Level
This vulnerability has been assigned a Common Vulnerability Scoring System (CVSS) score of 3.3 out of 10, classifying it as “Low” severity. This rating indicates that exploiting this flaw typically requires some form of user interaction, such as clicking on a malicious link. The primary impact is not on the confidentiality or availability of your data, but rather on its integrity, as users could be redirected to an unintended or potentially harmful external site. This type of vulnerability can sometimes be leveraged in phishing attacks.
Possible Solutions
Fortunately, a direct and effective patch is available to resolve this vulnerability. To safeguard your Nextcloud instance and its users, it is strongly recommended that you update your Nextcloud User OIDC application to version 8.2.2 or any subsequent version immediately. This update directly addresses the underlying weakness and prevents attackers from successfully exploiting the open redirect flaw. As no other practical workarounds are available for this specific issue, applying the official patch remains the most reliable and recommended course of action.
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73
- https://github.com/nextcloud/user_oidc/pull/1273
- https://hackerone.com/reports/3464925
