CVE-2026-45284 Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
Deleted LDAP users could still authenticate via the Nextcloud User OIDC app due to an improper check, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-45284?
CVE-2026-45284 is a medium-severity authentication bypass vulnerability in nextcloud security-advisories, published on 1 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper check allowed users that where provided by LDAP to still authenticate towards user OIDC after they where deleted. This issue has been patched in version 8.4.0.
Weakness: CWE-284
Which versions are affected by CVE-2026-45284?
It affects 1 product.
Products include Nextcloud User Oidc.
How do I fix CVE-2026-45284?
No fix has been published for CVE-2026-45284 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-45284 being exploited?
There is no known exploitation of CVE-2026-45284 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2023-32074 Nextcloud user_oidc app is missing brute force protection
- CVE-2024-37312 Nextcloud user_oidc app's ID4me feature is available even when disabled
- CVE-2024-37886 Nextcloud user_oidc's ID4me does not validate signature or expiration
- CVE-2023-39953 Issuer not verified from obtained token in user_oidc
- CVE-2023-28848 CSRF protection on user_oidc login returned the expected token in case of an error
Sources
Also known as GHSA-79xf-ffj8-96fm.