Nextcloud OIDC ID4me Impersonation Missing Sig Verif (3.0, 5.05.1...)
CVE-2026-45156 Published on June 1, 2026
Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.
Vulnerability Analysis
CVE-2026-45156 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-45156 has been classified to as an authentification vulnerability or weakness.
Affected Versions
nextcloud security-advisories:- Version >= 0.3.0, < 3.1.0 is affected.
- Version >= 5.0.0, < 5.1.0 is affected.
- Version >= 6.0.0, < 6.4.0 is affected.