CVE-2026-45278
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
Risk Assessment
The risk involves potential phishing attacks where users could be redirected to a malicious site, leading to theft of login credentials or other sensitive information.
Recommendation
It is recommended to immediately upgrade Nextcloud to version 8.2.2 or later, which includes a fix that eliminates the redirect vulnerability.
Original NVD description (English source)
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.