CVE-2026-45691

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions 32.0.0 through 32.0.8 Nextcloud Server versions 33.0.0 through 33.0.2 Nextcloud Enterprise Server versions prior to 29.0.16.16 Nextcloud Enterprise Server versions prior to 30.0.17.9 Nextcloud Enterprise Server versions prior to 31.0.14.5 Nextcloud Enterprise Server versions prior to 32.0.9 Nextcloud Enterprise Server versions prior to 33.0.3

Description A pre-2FA session cookie, which is generated after a user successfully provides a password but before completing the Time-based One-Time Password (TOTP) verification, can be reused as a Bearer token. This allows an attacker to authenticate against DAV endpoints, granting unauthorized read and write access while bypassing mandatory two-factor authentication.

Recommendations Upgrade Nextcloud Server to version 32.0.9 or 33.0.3. Upgrade Nextcloud Enterprise Server to version 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, or 33.0.3.