CVE-2026-45691

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45691
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45691.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45691
Aliases
Published
2026-06-01T17:09:48.217Z
Modified
2026-08-04T11:51:00.405343806Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
Nextcloud: Bypass of second factor authentication on DAV endpoints
Details

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45691.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
5ee29decb00508122f008abacea26fb3e122b13c
Fixed
4671436d69566600853aedaec61cb27966480075
Introduced
72c37934b777f496bf6b9bc12e5d702423a22d8a
Fixed
360808e82fd5af666d51e8ab143d54febe7d8d9e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "32.0.0"
        },
        {
            "fixed": "32.0.9"
        },
        {
            "introduced": "33.0.0"
        },
        {
            "fixed": "33.0.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v32.*
v32.0.0
v32.0.1
v32.0.1rc1
v32.0.1rc2
v32.0.2
v32.0.2rc1
v32.0.2rc2
v32.0.3
v32.0.3rc1
v32.0.3rc2
v32.0.4
v32.0.4rc1
v32.0.5
v32.0.6
v32.0.6rc1
v32.0.7
v32.0.7rc1
v32.0.8
v32.0.8rc1
v32.0.9rc1
v32.0.9rc2
v33.*
v33.0.0
v33.0.1
v33.0.1rc1
v33.0.1rc2
v33.0.2
v33.0.2rc1
v33.0.3rc1
v33.0.3rc2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45691.json"