CVE-2026-45156: Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC

Synopsis

Authentication bypass in Nextcloud User OIDC allows a malicious ID4me authority to impersonate any user without presenting a valid identity. The flaw is reachable over the network, requires no attacker authentication, but does require the victim to interact with a crafted login flow, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:R). Successful exploitation gives an attacker full read and write access to the victim's Nextcloud account. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment fix versions are confirmed published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Nextcloud login endpoint over the network to deliver the malicious ID4me authority response.

• AuthenticationNot required

  No account or credentials on the target Nextcloud instance are needed before exploitation begins.

• Victim interactionRequired

  The victim must initiate or be directed through the ID4me login flow, making this a social-engineering or phishing-assisted attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental factors beyond controlling or spoofing the ID4me authority.

Blast Radius

• A successful attacker gains access to the impersonated user's stored files, shared documents, and collaboration data.
• The attacker can modify, overwrite, or delete files and content owned by the victim account.
• If the impersonated account holds administrative privileges in Nextcloud, the attacker inherits those privileges and can reconfigure the instance or access other users' data.