← Back

CVE-2026-45278

nvd nist
Published: Jun 1, 2026Modified: Jul 20, 2026

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

Affected (1)

Products: Nextcloud: User Oidc
Nextcloud
1 product
User Oidc
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
User Oidc
From 6.1.0 to 8.2.2

Related CWEs

CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (3)

Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Permissions Required

Timeline

No history available yet.