Vulnerability Description
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | User Oidc | >= 6.1.0, < 8.2.2 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5Vendor Advisory
- https://github.com/nextcloud/user_oidc/pull/1273Issue TrackingPatch
- https://hackerone.com/reports/3464925Permissions Required
FAQ
What is CVE-2026-45278?
CVE-2026-45278 is a vulnerability with a CVSS score of 3.3 (LOW). Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses t...
How severe is CVE-2026-45278?
CVE-2026-45278 has been rated LOW with a CVSS base score of 3.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45278?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud User Oidc.