CVE-2026-45278: Nextcloud OIDC Open Redirect Vulnerability – Patch Available

Technical summary

CVE-2026-45278 is an open redirect vulnerability (CWE-601) in the Nextcloud user_oidc module. The flaw allows attackers to inject arbitrary URLs into login redirect flows. When a user authenticates via OIDC using an attacker-crafted link, the application redirects them to a URL controlled by the attacker after successful authentication. The vulnerability stems from insufficient validation or sanitization of redirect parameters in the OIDC authentication handler, a common pattern in OAuth/OIDC implementations when destination URLs are not properly validated against a whitelist.

Business impact

Open redirects in authentication flows can facilitate phishing and credential harvesting. Post-login redirection to attacker sites increases the risk of malware distribution or secondary exploitation, as users may trust the redirect context following a successful login event. For organizations relying on Nextcloud for file collaboration and content management, this could undermine user confidence in the authentication process and create vectors for social engineering attacks. The impact is moderate in scope because it requires user action and awareness to be exploited effectively.

Affected systems

Nextcloud user_oidc module versions 6.1.0 through 8.2.1 are affected. Organizations using Nextcloud with OIDC-based user authentication should audit their deployments to confirm the version in use. This affects both self-hosted Nextcloud instances and any Nextcloud deployment integrating external identity providers via OIDC.

Exploitability

Exploitation requires social engineering: an attacker crafts a malicious login link and sends it to a user, relying on them to click it. No authentication or special privileges are required on the attacker's side. The attack has low complexity but depends on user interaction (UI:R in the CVSS vector). The open redirect occurs only after successful authentication, which may reduce perceived urgency for the user to notice or question the redirect destination. This makes it suitable for targeted phishing campaigns but not mass exploitation without significant social effort.

Remediation

Upgrade to Nextcloud version 8.2.2 or later. This version contains the patch that validates and sanitizes redirect URLs in the OIDC authentication flow. Organizations should treat this as a routine security update rather than an emergency patch given the low CVSS score, but it should still be prioritized in the normal patching cycle, particularly if the Nextcloud instance is exposed to untrusted networks or used in high-security environments.

Patch guidance

Apply Nextcloud version 8.2.2 or newer to all affected instances. Verify the patch by confirming the version in Nextcloud's admin panel (Settings > Administration > Overview) or via command-line tools (e.g., `occ config:system:get version`). Test the patch in a non-production environment first to ensure OIDC authentication continues to function correctly with your identity provider. No configuration changes are required post-patch; the security fix is applied transparently.

Detection guidance

Monitor authentication logs for unusual redirect patterns or URL parameters in OIDC login requests. Look for redirect parameter manipulation in web server or application logs. Examine OIDC provider logs for unexpected post-authentication redirects to external domains. Implement URL schema validation at the network level if possible, and educate users to verify that post-login redirects align with expected Nextcloud domains. Organizations may also monitor for phishing complaints correlated with Nextcloud login attempts.

Why prioritize this

This vulnerability merits standard (not urgent) priority in most environments. The CVSS score of 3.3 reflects low severity, and real-world exploitation requires social engineering. However, organizations in highly sensitive environments (government, financial, healthcare) should patch sooner due to the phishing and credential theft vectors. Prioritize patching for externally facing Nextcloud instances or those accessed by high-value users who may be targeted. Internal-only deployments can follow routine update schedules.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects: Attack Vector Local (AV:L) acknowledges the attacker must craft and deliver a link; Attack Complexity Low (AC:L) because link crafting is trivial; Privileges Required None (PR:N) as no account is needed; User Interaction Required (UI:R) because the victim must click the link; Scope Unchanged (S:U) as impact is limited to the user's session; Confidentiality None (C:N) as no data is exposed; Integrity Low (I:L) because the redirect may lead to malicious content; Availability None (A:N). The score appropriately captures a phishing-grade threat that is real but constrained by user agency.

Frequently asked questions