Nextcloud Server CVE-2026-45690

Exploitation requires two concrete preconditions: (1) the attacker must possess the target user's valid Nextcloud account password - this is not unauthenticated exploitation, as confirmed by the CVSS PR:L rating; and (2) the target account must have two-factor authentication enabled, since the vulnerability only exists in the transient session state created during the 2FA challenge flow. Accounts without 2FA enabled are not subject to this specific bypass. The CVSS AC:H rating reflects the operational requirement to extract or intercept the temporary session token within the brief window between credential validation and 2FA challenge delivery. Affected versions are Nextcloud Server 32.0.0-32.0.8 and 33.0.0-33.0.2, and Nextcloud Enterprise Server in the 29.x, 30.x, and 31.x branches prior to their respective fixed versions. Exploitation is not automatable at scale because each attack requires individualized, previously obtained credentials per target account.

The CVSS 5.9 Medium score reflects a nuanced but operationally significant risk profile. AV:N confirms remote exploitability over the network. AC:H indicates high attack complexity - the attacker must capture the transient temporary token within the narrow authentication window and must already hold the victim's valid password (PR:L), making this a targeted rather than opportunistic threat. The integrity impact is rated High (I:H), reflecting that a successful bypass grants full authenticated account access; the Low confidentiality rating (C:L) may be conservative given that account access typically exposes stored files, contacts, and calendar data. No availability impact is present (A:N). EPSS data was not provided and exploitation probability must be treated as unquantified. KEV status is negative - no CISA-confirmed active exploitation at time of analysis. No public POC code has been identified; the HackerOne report (#3639301) indicates responsible disclosure. However, the publicly available PR diff on GitHub documents the exact vulnerable code paths in sufficient detail for a capable researcher to reconstruct an exploit. The primary real-world threat is targeted attacks against accounts where an adversary already holds credentials and 2FA is the sole remaining defense - a scenario common in credential-stuffing victim populations. For those deployments, the vulnerability is functionally critical despite the moderate CVSS score.

An attacker who has obtained a Nextcloud user's password - through phishing, credential stuffing, or a prior data breach - programmatically initiates a login request with those credentials against the target instance. Before the 2FA challenge is delivered to the legitimate user, the attacker captures the temporary session token returned by the server in the intermediate authentication state. The attacker then presents this TEMPORARY_TOKEN as HTTP Basic Authentication credentials or a Bearer header to Nextcloud API endpoints, gaining full authenticated session access without ever supplying a valid second factor. No public exploit code has been identified, but the fix diff in PR #59758 makes the vulnerable code path and the required token mechanics technically explicit.