CVE-2026-45156Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

Beschreibung

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgv-fqwp-mjpp
• https://github.com/nextcloud/user_oidc/pull/1285
• https://hackerone.com/reports/3489490