CVE-2026-45690: Nextcloud Server 2FA Bypass Vulnerability

CVE-2026-45690 Overview

CVE-2026-45690 is an authentication bypass vulnerability in Nextcloud Server that allows attackers with knowledge of a valid user password to circumvent two-factor authentication (2FA). The flaw exists in Nextcloud Server versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3. When a user initiates login on a 2FA-enabled account, the system issues a temporary session token before the second factor challenge completes. An attacker can extract this token and replay it via HTTP Basic Authentication to access authenticated endpoints. The weakness is classified under [CWE-287] Improper Authentication.

Critical Impact

Attackers possessing a valid username and password can fully bypass 2FA protections and access authenticated Nextcloud endpoints, defeating the second factor security control.

Affected Products

• Nextcloud Server 32.0.0 through versions before 32.0.9
• Nextcloud Server 33.0.0 through versions before 33.0.3
• Nextcloud Enterprise Server branches 29.x, 30.x, 31.x, 32.x, and 33.x prior to fixed releases

Discovery Timeline

• 2026-06-01 - CVE-2026-45690 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-45690

Vulnerability Analysis

The vulnerability resides in the Nextcloud Server login flow for accounts protected by two-factor authentication. When valid primary credentials are submitted, the server creates a session token before the second factor challenge is enforced. This token represents a partially authenticated state that should not grant access to protected resources. However, the token is accepted by endpoints that authenticate via HTTP Basic Authentication, effectively skipping the 2FA verification step.

An attacker with knowledge of a target user's password can drive the login process, capture or replay the intermediate token, and access authenticated APIs. The bypass undermines the integrity guarantee that 2FA is meant to provide for high-value accounts, including administrators and file owners.

Root Cause

The root cause is a state validation gap in the authentication state machine. The server issues a session credential during a transitional authentication state but fails to scope that credential to the 2FA challenge endpoint only. Downstream Basic Authentication handlers accept the token without verifying whether the second factor has been satisfied, breaking the security boundary between credential verification and full session establishment.

Attack Vector

Exploitation requires network access to the Nextcloud Server and prior knowledge of a valid username and password. The attacker submits credentials to trigger the 2FA flow, intercepts or extracts the issued token, and then issues HTTP requests using Basic Authentication carrying that token. The targeted endpoints accept the request and return authenticated responses without prompting for the second factor. The technical details, fix, and proof-of-concept context are documented in the Nextcloud GitHub Security Advisory GHSA-jgcj-v42r-9922, the server pull request, and HackerOne Report #3639301.

Detection Methods for CVE-2026-45690

Indicators of Compromise

• Successful HTTP Basic Authentication requests to Nextcloud endpoints from clients that never completed the 2FA challenge.
• Login sequences in which a login event is followed by API calls but no corresponding twofactor_success event for the same session.
• Repeated Basic Authentication requests from a single source IP reusing the same session identifier across multiple endpoints in a short window.

Detection Strategies

• Correlate Nextcloud authentication logs to flag sessions that issued tokens but never completed a second factor verification step before accessing data endpoints.
• Alert on access to sensitive endpoints such as WebDAV, file shares, or admin APIs when the authenticating session lacks a recorded 2FA completion.
• Hunt for unusual Basic Authentication usage against accounts configured with 2FA, since legitimate 2FA users typically authenticate through the web flow.

Monitoring Recommendations

• Forward Nextcloud data/nextcloud.log and web server access logs to a centralized logging platform for correlation across login and API events.
• Track authentication anomalies per user account, including geographic and user-agent deviations following password-only login attempts.
• Monitor for spikes in failed-then-successful login pairs that may indicate credential stuffing combined with 2FA bypass attempts.

How to Mitigate CVE-2026-45690

Immediate Actions Required

• Upgrade Nextcloud Server to version 33.0.3 or 32.0.9 as soon as possible.
• Upgrade Nextcloud Enterprise Server to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16 depending on the deployed branch.
• Invalidate active sessions and force re-authentication for all users after patching to revoke any tokens that may have been captured.
• Review authentication logs for prior abuse of Basic Authentication against 2FA-enabled accounts.

Patch Information

Nextcloud released fixes in Server versions 32.0.9 and 33.0.3, and in Enterprise Server versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, and 29.0.16.16. The corresponding code change is available in the Nextcloud server pull request #59758, and full advisory details are published in GHSA-jgcj-v42r-9922.

Workarounds

• Disable HTTP Basic Authentication for clients where feasible and require app passwords or OAuth-based authentication instead.
• Enforce password rotation for any account that may have authenticated during the vulnerable window, especially privileged users.
• Restrict network access to the Nextcloud instance using VPN or IP allow-listing until the upgrade is applied.

# Configuration example: upgrade Nextcloud Server via the built-in updater
sudo -u www-data php /var/www/nextcloud/updater/updater.phar
sudo -u www-data php /var/www/nextcloud/occ upgrade
sudo -u www-data php /var/www/nextcloud/occ maintenance:mode --off

# Invalidate existing sessions after patching
sudo -u www-data php /var/www/nextcloud/occ user:list | awk -F'[:-]' '{print $2}' | xargs -I{} sudo -u www-data php /var/www/nextcloud/occ user:logout {}