CVE-2026-45691CWE-287

Nextcloud: Bypass of second factor authentication on DAV endpoints

Medium · published June 1, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-01T17:09Z
EPSS history
Timeline
  • 01 JUN 17:09Z
    Nextcloud: Bypass of second factor authentication on DAV endpoints
    cvelistv5