CVE-2026-45690

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, an authentication bypass vulnerability allowed attackers with knowledge of a user's password to circumvent two-factor authentication (2FA) protections. When a user initiated login with valid credentials on a 2FA-enabled account, the system created a temporary session token before enforcing the second factor challenge. This token could be extracted and replayed via HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

• CWE-287

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-jgcj-v42r-9922Vendor Advisory
• https://github.com/nextcloud/server/pull/59758Issue Tracking, Patch
• https://hackerone.com/reports/3639301Permissions Required

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45685OpenTelemetry eBPF Instrumentation provides eBPF instrumenta…7.5
• CVE-2026-45686OpenTelemetry eBPF Instrumentation provides eBPF instrumenta…7.5
• CVE-2026-45687Rocket.Chat is an open-source, secure, fully customizable co…8.5
• CVE-2026-45688Rocket.Chat is an open-source, secure, fully customizable co…9.1
• CVE-2026-45689Rocket.Chat is an open-source, secure, fully customizable co…9.1
• CVE-2026-4569A vulnerability was determined in SourceCodester Sales and I…6.5
• CVE-2026-45691Nextcloud is an open source content collaboration platform. …5.9
• CVE-2026-45692Caddy is an extensible server platform that uses TLS by defa…3.8
• CVE-2026-45695Kopia is a cross-platform backup tool for Windows, macOS, an…9.8
• CVE-2026-45696OpenEXR is the reference implementation and specification fo…6.5
• CVE-2026-45697Formie is a Craft CMS plugin for creating forms. Prior to 2.…9.8
• CVE-2026-4570A vulnerability was identified in SourceCodester Sales and I…8.8