CVE-2026-45278

medium

Description

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

References

https://hackerone.com/reports/3464925

https://github.com/nextcloud/user_oidc/pull/1273

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73

Details

Source: Mitre, NVD

Published: 2026-06-01

Updated: 2026-06-03

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00011