CVE-2026-45691
Last modified
CVE-2026-45691 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Nextcloud Server | >= 32.0.0, < 32.0.9 |
| Nextcloud | Nextcloud Server | >= 33.0.0, < 33.0.3 |
| Nextcloud | Nextcloud Server | >= 29.0.0, < 29.0.16.16 |
| Nextcloud | Nextcloud Server | >= 30.0.0, < 30.0.17.9 |
| Nextcloud | Nextcloud Server | >= 31.0.0, < 31.0.14.5 |
References
- https://github.com/nextcloud/server/pull/59758Issue Tracking, Patch
- https://hackerone.com/reports/3573399Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-45691?
How severe is CVE-2026-45691?
How do I fix CVE-2026-45691?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-45686OpenTelemetry eBPF Instrumentation provides eBPF instrumenta…7.5
- CVE-2026-45687Rocket.Chat is an open-source, secure, fully customizable co…8.5
- CVE-2026-45688Rocket.Chat is an open-source, secure, fully customizable co…9.1
- CVE-2026-45689Rocket.Chat is an open-source, secure, fully customizable co…9.1
- CVE-2026-4569A vulnerability was determined in SourceCodester Sales and I…6.5
- CVE-2026-45690Nextcloud is an open source content collaboration platform. …5.9
- CVE-2026-45692Caddy is an extensible server platform that uses TLS by defa…3.8
- CVE-2026-45695Kopia is a cross-platform backup tool for Windows, macOS, an…9.8
- CVE-2026-45696OpenEXR is the reference implementation and specification fo…6.5
- CVE-2026-45697Formie is a Craft CMS plugin for creating forms. Prior to 2.…9.8
- CVE-2026-4570A vulnerability was identified in SourceCodester Sales and I…8.8
- CVE-2026-45700FreeRDP is a free implementation of the Remote Desktop Proto…9.8
Are you affected by CVE-2026-45691?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST