CVE-2026-45278: Nextcloud: Open Redirect in user_oidc login flow via protocol-relative URL bypass

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-01 · updated 2026-07-20
Weakness: CWE-601

Description

Nextcloud is an open source content collaboration platform. From version 6.1.0 to before version 8.2.2, an attacker can craft links that would redirect users to another website, when the victim uses the attackers link to log in via user OIDC. This issue has been patched in version 8.2.2.

Affected products

nextcloud User Oidc: from 6.1.0 before 8.2.2 — fixed in 8.2.2

How to fix

Upgrade to a fixed version: nextcloud User Oidc 8.2.2. Check the vendor advisory for mitigations.

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8wjr-5cg8-4w73
https://github.com/nextcloud/user_oidc/pull/1273
https://hackerone.com/reports/3464925

Get alerted when CVE-2026-45278 or the next vulnerability affects your stack