Medium severity · published Jun 1, 2026
CVE-2026-45278
Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 6.1.0, < 8.2.2 · source: vendor
UO
User Oidc · Nextcloud
6.1.0 before 8.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45278
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45278
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73
Issue Tracking
https://github.com/nextcloud/user_oidc/pull/1273
Permissions Required
https://hackerone.com/reports/3464925
More from security-advisories
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.8
CVE-2026-45284
Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
8.2
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
8.2
CVE-2024-52519
Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
8.1
CVE-2026-45281
Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update