Two-factor authentication (2FA) is a critical security layer designed to protect your accounts even if your password falls into the wrong hands. It adds an extra step to verify your identity, often through a code sent to your phone or generated by an app. Unfortunately, a recent discovery in Nextcloud Server revealed a way to bypass this crucial protection.
This vulnerability, identified as CVE-2026-45690, allowed attackers who already knew a user’s password to cleverly sidestep their 2FA. When a user started the login process, Nextcloud would create a temporary session token before asking for the second factor. An attacker could grab this temporary token and reuse it to gain unauthorized access, effectively bypassing the 2FA safeguard.
CVE Details
Product Name: Nextcloud Server
CVE ID: CVE-2026-45690
Published: June 1, 2026
Severity: Medium (CVSS: 5.9)
Status: Analyzed
Affected Products
This authentication bypass vulnerability impacts specific versions of Nextcloud Server and Nextcloud Enterprise Server:
- Nextcloud Server: Versions 32.0.0 through 32.0.8, and 33.0.0 through 33.0.2.
- Nextcloud Enterprise Server: Versions 29.0.0 through 29.0.16.15, 30.0.0 through 30.0.17.8, 31.0.0 through 31.0.14.4, 32.0.0 through 32.0.8, and 33.0.0 through 33.0.2.
Current Status
The vulnerability has been thoroughly analyzed, and Nextcloud has released patches to address the issue. Users are strongly advised to update their installations promptly to protect against potential exploitation.
Severity Level
Rated as Medium severity with a CVSS score of 5.9, this vulnerability presents a notable risk. The attack vector is via the network, meaning an attacker doesn’t need physical access to your server. While the attack complexity is considered high (requiring some specific knowledge or conditions), the fact that no user interaction is needed once the password is known makes it a serious concern. The vulnerability could lead to a high impact on data integrity, allowing unauthorized modification, and a low impact on confidentiality, potentially exposing sensitive information.
Possible Solutions
Nextcloud has released security updates to fix this authentication bypass. The most effective solution is to upgrade your Nextcloud installation to a patched version immediately.
- For Nextcloud Server users, upgrade to version 33.0.3 or 32.0.9.
- For Nextcloud Enterprise Server users, upgrade to version 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16.
At the time of this writing, there are no known workarounds for this vulnerability. Updating to the patched versions is the only recommended mitigation.
References
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922
https://github.com/nextcloud/server/pull/59758
https://hackerone.com/reports/3639301
