CVE-2026-45156CWE-287

Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

High · published June 1, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00554 · 45.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-01T16:38Z
EPSS history
Timeline
  • 01 JUN 16:38Z
    Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
    cvelistv5