Missing Signature Verification in Nextcloud OIDC Enables User Impersonation
CVE-2026-45156
8.1HIGH
What is CVE-2026-45156?
Nextcloud, a popular open-source content collaboration platform, has been identified with a vulnerability related to missing signature verification in its User OIDC implementation. This flaw allows a malicious ID4me authority to impersonate any user, potentially leading to unauthorized access and data exposure. Users of Nextcloud versions 0.3.0 through before 3.1.0, 5.0.0 through before 5.1.0, and 6.0.0 through before 6.4.0 are particularly at risk. To mitigate this issue, users are strongly advised to upgrade to patched versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, or later.
Affected Version(s)
security-advisories >= 0.3.0, < 3.1.0 < 0.3.0, 3.1.0
security-advisories >= 5.0.0, < 5.1.0 < 5.0.0, 5.1.0
security-advisories >= 6.0.0, < 6.4.0 < 6.0.0, 6.4.0