CVE-2026-45278

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45278
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45278.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45278
Aliases
  • GHSA-8wjr-5cg8-4w73
Published
2026-06-01T16:51:55Z
Modified
2026-08-12T03:51:33Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
Details

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45278.json"
}
References

Affected packages

Git / github.com/nextcloud/user_oidc

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/user_oidc
Events
Introduced
647dae678fa14b4b4e187204b8491608796fc92a
Fixed
574ee42273eab1e0e51aed56a8fa8d3dd842f24e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:nextcloud:user_oidc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.1.0"
        },
        {
            "fixed": "8.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v6.*
v6.1.0
v6.1.1
v6.1.2
v6.2.0
v6.2.1
v6.3.0
v6.3.1
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.3.0
v7.3.1
v7.3.2
v7.4.0
v8.*
v8.0.0
v8.1.0
v8.2.0
v8.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45278.json"