Vulnerability from bitnami_vulndb
Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16
{
"affected": [
{
"package": {
"ecosystem": "Bitnami",
"name": "nextcloud",
"purl": "pkg:bitnami/nextcloud"
},
"ranges": [
{
"events": [
{
"introduced": "32.0.0"
},
{
"fixed": "32.0.9"
},
{
"introduced": "33.0.0"
},
{
"fixed": "33.0.3"
}
],
"type": "SEMVER"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
],
"aliases": [
"CVE-2026-45691"
],
"database_specific": {
"cpes": [
"cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*"
],
"severity": "Medium"
},
"details": "Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, a pre-2FA session cookie (created after successful password authentication but before TOTP completion) could be reused as a Bearer token to authenticate against DAV endpoints, granting read/write access and bypassing mandatory two-factor authentication. It is recommended that the Nextcloud Server is upgraded to 33.0.3 or 32.0.9. It is recommended that the Nextcloud Enterprise Server is upgraded to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16",
"id": "BIT-nextcloud-2026-45691",
"modified": "2026-09-08T08:34:36.952Z",
"published": "2026-07-12T23:48:05.001Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mp6x-g55j-w9jw"
},
{
"type": "FIX",
"url": "https://github.com/nextcloud/server/pull/59758"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3573399"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45691"
}
],
"schema_version": "1.6.2",
"summary": "Nextcloud: Bypass of second factor authentication on DAV endpoints"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.