CVE-2026-45156

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2026-06-01

Updated

2026-06-03

Proof-of-concept exploits (1)

• cybertechajju/CVE-2026-45156-POC

References

• CVE Record
• NVD entry

Related

• CVE-2025-14847
• CVE-2025-55182
• CVE-2025-55184
• CVE-2025-5777
• CVE-2025-57819
• CVE-2026-1357