CVE-2026-45691

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45691", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-13T04:38:01.164Z", "datePublished": "2026-06-01T17:09:48.217Z", "dateUpdated": "2026-06-01T19:10:18.647Z"}, "containers": {"cna": {"title": "Nextcloud: Bypass of second factor authentication on DAV endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw"}, {"name": "https://github.com/nextcloud/server/pull/59758", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/server/pull/59758"}, {"name": "https://hackerone.com/reports/3573399", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/3573399"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 32.0.0, < 32.0.9", "status": "affected"}, {"version": ">= 33.0.0, < 33.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T17:09:48.217Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16"}], "source": {"advisory": "GHSA-mp6x-g55j-w9jw", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T19:09:58.256884Z", "id": "CVE-2026-45691", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T19:10:18.647Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45691", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T19:09:58.256884Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T19:10:13.291Z"}}], "cna": {"title": "Nextcloud: Bypass of second factor authentication on DAV endpoints", "source": {"advisory": "GHSA-mp6x-g55j-w9jw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 32.0.0, < 32.0.9"}, {"status": "affected", "version": ">= 33.0.0, < 33.0.3"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/server/pull/59758", "name": "https://github.com/nextcloud/server/pull/59758", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/3573399", "name": "https://hackerone.com/reports/3573399", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-01T17:09:48.217Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45691", "state": "PUBLISHED", "dateUpdated": "2026-06-01T19:10:18.647Z", "dateReserved": "2026-05-13T04:38:01.164Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-01T17:09:48.217Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "security-advisories", "vendor": "nextcloud", "versions": [{"status": "affected", "version": ">= 32.0.0, < 32.0.9"}, {"status": "affected", "version": ">= 33.0.0, < 33.0.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "matchCriteriaId": "A4E473E0-CAC5-4C49-AA6A-84E16C6EAA13", "versionEndExcluding": "32.0.9", "versionStartIncluding": "32.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*", "matchCriteriaId": "9B2B8E97-72E8-48AE-85F0-9FB5CE692F14", "versionEndExcluding": "33.0.3", "versionStartIncluding": "33.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C98F45A0-2CF9-4534-8EEA-52AA5682DFA5", "versionEndExcluding": "29.0.16.16", "versionStartIncluding": "29.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "DA06C26B-C42D-4760-BE2D-F20749B36EF1", "versionEndExcluding": "30.0.17.9", "versionStartIncluding": "30.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4FA400BC-693E-461C-B900-37D8ECA22407", "versionEndExcluding": "31.0.14.5", "versionStartIncluding": "31.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "E0868A4E-159B-40EC-9633-82B82E87ADA0", "versionEndExcluding": "32.0.9", "versionStartIncluding": "32.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "1AD6566B-8299-4BDD-9ADD-8259D0EE4245", "versionEndExcluding": "33.0.3", "versionStartIncluding": "33.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16"}, {"lang": "es", "value": "Nextcloud es una plataforma de colaboraci\u00f3n de contenido de c\u00f3digo abierto. En Nextcloud Server desde las versiones 32.0.0 hasta antes de la 32.0.9, y 33.0.0 hasta antes de la 33.0.3, una cookie de sesi\u00f3n pre-2FA (creada despu\u00e9s de una autenticaci\u00f3n de contrase\u00f1a exitosa pero antes de la finalizaci\u00f3n de TOTP) podr\u00eda ser reutilizada como un token Bearer para autenticarse contra los puntos finales DAV, otorgando acceso de lectura/escritura y eludiendo la autenticaci\u00f3n de dos factores obligatoria. Se recomienda que el Nextcloud Server sea actualizado a 33.0.3 o 32.0.9. Se recomienda que el Nextcloud Enterprise Server sea actualizado a 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 o 29.0.16.16"}], "id": "CVE-2026-45691", "lastModified": "2026-07-22T08:10:00.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45691", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T19:09:58.256884Z", "version": "2.0.3"}}]}, "published": "2026-06-01T19:16:52.673", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nextcloud/server/pull/59758"}, {"source": "security-advisories@github.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3573399"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[32.0.0,32.0.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[33.0.0,33.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "security-advisories", "source": "cna", "vendor": "nextcloud"}, "product": "nextcloud_server", "vendor": "nextcloud"}], "created": "2026-06-01T20:45:25.622403+00:00", "updated": "2026-06-02T20:53:35.449431+00:00", "vendors": ["nextcloud", "nextcloud$PRODUCT$nextcloud_server"]}