What is the CVSS score of CVE-2026-45156?

CVE-2026-45156 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Nextcloud User OIDC are affected by CVE-2026-45156?

Nextcloud User OIDC app (versions 0.3.0-3.0.x, 5.0.0-5.0.x, 6.0.0-6.3.x) contains an authentication bypass vulnerability enabling attackers to impersonate arbitrary users through compromised ID4me…. A patch is available.

How to fix or mitigate CVE-2026-45156?

Within 24 hours: Audit all Nextcloud deployments running OIDC app versions 0.3.0-3.0.x, 5.0.0-5.0.x, or 6.0.0-6.3.x to identify systems using ID4me as an authentication provider. Within 7 days: Disable ID4me authentication in affected instances; migrate users to alternative authentication methods such as SAML or standard OAuth2 providers; implement network monitoring for ID4me authentication attempts. Within 30 days: Maintain continuous monitoring of Nextcloud security advisories for patch availability and establish a rapid deployment process for application within 48 hours of release.

Nextcloud User OIDC CVE-2026-45156

EUVD-2026-33675 HIGH

Improper Authentication (CWE-287)

2026-06-01 GitHub_M

Authentication Bypass Nextcloud Security Advisories

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:19 vuln.today

Analysis Generated

Jun 01, 2026 - 17:19 vuln.today

DescriptionCVE.org

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

AnalysisAI

Authentication bypass in Nextcloud's User OIDC app (versions 0.3.0-3.0.x, 5.0.0-5.0.x, and 6.0.0-6.3.x) allows a malicious ID4me authority to impersonate arbitrary users due to missing JWT signature verification in the ID4me login flow. The flaw stems from a literal 'TODO: VALIATE SIGNATURE!' code comment that left ID tokens accepted without cryptographic validation, enabling identity spoofing once a victim is redirected through the attacker-controlled authority. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability lives in the User OIDC Nextcloud app's Id4meController::code() handler (lib/Controller/Id4meController.php), which processes the OpenID Connect / ID4me authorization-code callback. ID4me is a federated identity protocol layered on top of OIDC that uses DNS to discover an identity authority, which then issues a signed JWT ID token. The pre-patch code decoded the JWT payload and trusted its claims without ever calling JWT::decode() against the authority's JWKS, so any party able to act as an ID4me authority could mint a token claiming any 'sub' identifier. The root cause is classic CWE-287 (Improper Authentication) - specifically the well-known JWT pitfall of treating the unverified payload as authoritative. The fix introduces an obtainJWK() helper in ID4MeService that fetches and caches the JWKS from the discovery document's jwks_uri, then invokes Firebase JWT's decode() with RS256 verification and a 60-second leeway, returning HTTP 403 with reason 'token signature check failed' on validation failure.

RemediationAI

Vendor-released patches are available: upgrade the user_oidc app to 3.1.0, 4.1.0, 5.1.0, 6.4.0, or 8.3.0 depending on the major version line currently deployed, per the advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgv-fqwp-mjpp and PR https://github.com/nextcloud/user_oidc/pull/1285. If immediate patching is not possible, disable the ID4me login option in the User OIDC admin settings (the standard OIDC provider flows in the same app are unaffected by this specific signature-verification gap), which eliminates the vulnerable code path at the cost of breaking any existing ID4me-based federation. Organizations relying on ID4me as a primary login method should plan a maintenance window for the upgrade and invalidate active sessions afterward, since pre-patch sessions could have been established with unverified tokens; review audit logs for unexpected logins via the ID4me handler before then.