CVE-2026-45278: Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass
Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloudto a version that resolves this vulnerability.Fixed in 8.2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45278?
The severity of CVE-2026-45278 is rated as medium with a score of 6.1.
What is CVE-2026-45278 about?
CVE-2026-45278 is an open redirect vulnerability in Nextcloud’s user_oidc login flow that allows attackers to redirect users to malicious websites.
How do I fix CVE-2026-45278?
CVE-2026-45278 can be fixed by updating Nextcloud to version 8.2.2 or later where the vulnerability has been patched.
Which versions of Nextcloud are affected by CVE-2026-45278?
CVE-2026-45278 affects Nextcloud versions from 6.1.0 up to but not including 8.2.2.
What type of attack does CVE-2026-45278 enable?
CVE-2026-45278 enables attackers to exploit an open redirect by crafting links that redirect users to arbitrary websites during user OIDC login.