CVE-2026-45156Disclosure

LOWCVSS 8.1 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Nextcloud is an open source content collaboration platform. From versions 0.3.0 to before 3.1.0, 5.0.0 to before 5.1.0, and 6.0.0 to before 6.4.0, a missing signature verification in User OIDC allowed a malicious ID4me authority to identify as any user. This issue has been patched in versions 3.1.0, 4.1.0, 5.1.0, 6.4.0 and 8.3.0.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-06-08); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-01	1	Disclosure1
2026-06-08	2	Disclosure1Patch1
2026-06-10	1	Disclosure1

Full discourse4 posts

Densel@luckyhacker43130d
Disclosure
$2,500 [CVE-2026-45156] Nextcloud Bug Bounty 💰 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC 🤯🔥 👨‍💻 cybertechajju (h1/cybertechajju) 👨‍💻 priyanka chandrakar (h1/priyanka010) 🔗 https://t.me/luckyhacker43 https://t.co/ad8h2FtBYT
Post summary
The tweet announces CVE‑2026‑45156, describing an authentication bypass in Nextcloud’s ID4me handling due to missing JWT signature verification.
12039151.5K
2.7K followersView on X
Densel@luckyhacker43128d
Disclosure
$2,500 [CVE-2026-45156] Nextcloud Bug Bounty 💰 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC 🤯🔥 👨‍💻 cybertechajju (h1/cybertechajj 🔗 https://hackerone.com/reports/3489490 🔗 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgv-fqwp-mjpp 🔗 Join team 👉https://t.me/luckyhacker43 https://t.co/QlbR51d7ZY
Post summary
The post announces a 2,500 $ bug bounty for CVE-2026-45156 in Nextcloud, describing an authentication bypass due to missing JWT signature verification. It links to a HackerOne report and a GitHub advisory but does not mention active exploitation, patches, or debunking.
01036181.1K
2.8K followersView on X
N45HT@N45HTOfficial130d
Patch
$2,500 [CVE-2026-45156] Nextcloud Bug Bounty 💰 Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC 🤯🔥 👨‍💻 cybertechajju (h1/cybertechajju) 👨‍💻 priyanka chandrakar (h1/priyanka010) 🔗 https://hackerone.com/reports/3489490 🔗 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qqgv-fqwp-mjpp https://t.co/0TZ9rjexcG
Post summary
The post announces CVE-2026‑45156, an authentication bypass due to missing JWT signature verification, references a HackerOne report and a GitHub advisory that include a patch, but no exploit is shared or noted as in the wild.
0101088
99 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
Disclosure
CVE-2026-45156 Missing Signature Verification in Nextcloud User OIDC Multiple Versions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45156
Post summary
The post announces a Nextcloud OIDC-related vulnerability (CVE-2026-45156) that lacks signature verification, providing a link to a vulnerability details page but no PoC, exploit, or mitigation information.
0001044
4.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-45156

Densel@luckyhacker43Disclosure

The tweet announces CVE‑2026‑45156, describing an authentication bypass in Nextcloud’s ID4me handling due to missing JWT signature verification.

Densel@luckyhacker43Disclosure

The post announces a 2,500 $ bug bounty for CVE-2026-45156 in Nextcloud, describing an authentication bypass due to missing JWT signature verification. It links to a HackerOne report and a GitHub advisory but does not mention active exploitation, patches, or debunking.

N45HT@N45HTOfficialPatch

The post announces CVE-2026‑45156, an authentication bypass due to missing JWT signature verification, references a HackerOne report and a GitHub advisory that include a patch, but no exploit is shared or noted as in the wild.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces a Nextcloud OIDC-related vulnerability (CVE-2026-45156) that lacks signature verification, providing a link to a vulnerability details page but no PoC, exploit, or mitigation information.