Nextcloud user_oidc CVE-2026-45278

The Nextcloud user_oidc plugin must be installed and enabled, and OIDC login must be configured and reachable by end users - Nextcloud instances using only local accounts or LDAP authentication are not affected. The attacker requires no account or privileges on the Nextcloud server (PR:N per CVSS). The victim must click the attacker-crafted link and complete the OIDC authentication flow (UI:R per CVSS confirms required user interaction). Exploitation is bounded to user_oidc plugin versions 6.1.0 through 8.2.1; instances running 8.2.2 or later are patched. Note: the CVSS AV:L (Local) vector is inconsistent with the network-deliverable attack model described - the actual prerequisite is the ability to deliver a URL to a victim, not local system access. Defenders should not treat AV:L as limiting the realistic exposure of this vulnerability.

CVSS rates this 3.3 (Low), driven by Integrity:Low impact with no Confidentiality or Availability impact, and a Local attack vector (AV:L). However, the AV:L designation is inconsistent with the attack description - an open redirect exploited via a crafted URL delivered to a victim over the network is canonically AV:N. This discrepancy should be flagged and verified with the vendor or NVD; the real-world attack surface is broader than the vector implies. No EPSS data was provided in source intelligence. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, though the HackerOne report (https://hackerone.com/reports/3464925) confirms independent researcher discovery. Practical risk centers on phishing: attackers can weaponize the trusted Nextcloud domain name and OIDC flow to establish false legitimacy before redirecting victims. For organizations using Nextcloud for sensitive collaboration with federated OIDC identity providers, the phishing risk exceeds what the low CVSS score suggests, particularly against non-technical end users.

An attacker crafts a Nextcloud OIDC login URL embedding a protocol-relative redirect target such as '//attacker.com/fake-login' in the redirect parameter. The victim receives this link via a phishing email that appears legitimate because the domain is the trusted Nextcloud instance; upon clicking and completing OIDC authentication, Nextcloud's LoginController processes the unvalidated redirectUrl and issues a redirect to the attacker's site. No exploit code has been publicly released, but the technique requires only basic URL crafting skills and no access to the Nextcloud server itself.