CVE-2026-45156: Nextcloud User OIDC Auth Bypass Flaw

CVE-2026-45156 Overview

CVE-2026-45156 is an authentication bypass vulnerability in the Nextcloud user_oidc application. The flaw stems from missing signature verification when processing ID4me authority responses. A malicious ID4me authority can impersonate any user on the affected Nextcloud instance.

The vulnerability affects user_oidc versions 0.3.0 through 3.0.x, 5.0.0 through 5.0.x, and 6.0.0 through 6.3.x. Patches are available in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. The issue is classified under [CWE-287] Improper Authentication.

Critical Impact
A malicious ID4me identity authority can authenticate as any user on the Nextcloud instance, leading to full account takeover and unauthorized access to collaboration data.

Affected Products

Nextcloud user_oidc versions 0.3.0 to before 3.1.0
Nextcloud user_oidc versions 5.0.0 to before 5.1.0
Nextcloud user_oidc versions 6.0.0 to before 6.4.0

Discovery Timeline

2026-06-01 - CVE-2026-45156 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-45156

Vulnerability Analysis

The user_oidc application integrates Nextcloud with OpenID Connect (OIDC) identity providers, including ID4me authorities. ID4me is a federated identity system that delegates authentication to user-selected authorities. The vulnerability arises because the application accepts identity assertions from ID4me authorities without verifying the cryptographic signature on the returned tokens.

Without signature verification, the trust model collapses. Any party that can position itself as an ID4me authority can forge identity claims for arbitrary user identifiers. The Nextcloud server then provisions or authenticates sessions based on those forged claims, granting access to the targeted account.

User interaction is required because authentication flows are initiated through the browser. However, the attacker controls the authority response, so crafting a malicious assertion is straightforward once a victim begins authentication against the rogue authority.

Root Cause

The root cause is missing validation of the JSON Web Token (JWT) or assertion signature returned by ID4me authorities. The patched releases add signature verification against the authority's published keys, restoring the integrity guarantees expected by the OIDC specification. See the GitHub Pull Request Discussion for code-level remediation details.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker operates or compromises an ID4me authority. The attacker then induces a victim Nextcloud instance to authenticate against that authority, supplying a forged identity assertion that claims the identifier of any target user. Because the signature is not validated, the assertion is accepted and the attacker gains the target user's session. Refer to the GitHub Security Advisory and the HackerOne Security Report for further technical context.

Detection Methods for CVE-2026-45156

Indicators of Compromise

Successful OIDC authentication events referencing unfamiliar or untrusted ID4me authority endpoints in Nextcloud logs.
Account logins from new IP addresses or geolocations immediately following an OIDC callback to /apps/user_oidc/.
Creation of OIDC-provisioned user accounts that do not correspond to expected directory entries.

Detection Strategies

Audit nextcloud.log and webserver access logs for OIDC callback requests with unexpected iss (issuer) values.
Compare authenticated session user identifiers against the configured ID4me authority allowlist for discrepancies.
Alert on first-time use of an ID4me authority not previously seen in environment baselines.

Monitoring Recommendations

Forward Nextcloud application and webserver logs to a centralized SIEM for correlation across authentication events.
Track session creation rates per OIDC provider and alert on anomalous spikes.
Monitor administrative changes to the user_oidc provider configuration that add or modify ID4me authorities.

How to Mitigate CVE-2026-45156

Immediate Actions Required

Upgrade user_oidc to version 3.1.0, 4.1.0, 5.1.0, 6.4.0, or 8.3.0 depending on the deployed branch.
Review existing OIDC provider configurations and remove any ID4me authorities that are not explicitly required.
Invalidate active sessions and force re-authentication for accounts that may have used ID4me flows.

Patch Information

Nextcloud has released fixed versions of the user_oidc application: 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. The patch introduces signature verification on assertions returned from ID4me authorities. Administrators should apply the update through the Nextcloud app store or by deploying the updated package from the official repository. Full remediation details are published in the GitHub Security Advisory.

Workarounds

Disable the user_oidc application entirely if ID4me-based authentication is not in active use.
Restrict the configured OIDC providers to internal or trusted authorities only, removing ID4me discovery capability.
Place Nextcloud behind a reverse proxy that enforces additional authentication, such as mutual TLS, until the patch is applied.

bash

# Disable the user_oidc app via occ until patching is complete
sudo -u www-data php occ app:disable user_oidc

# After updating, re-enable and verify version
sudo -u www-data php occ app:enable user_oidc
sudo -u www-data php occ app:list | grep user_oidc