Summary
Temporary session tokens can bypass two-factor authentication. This medium-severity finding affects Nextcloud Server.
Disclosure timeline
- Public disclosure
Credits
Cantina · Agent-discovered and human-verified
Vulnerability disclosure
Temporary session tokens can bypass two-factor authentication
CVE-2026-45690
- Affected product
- Nextcloud Server
- Severity
- Medium · CVSS 5.9
- Weakness
- CWE-287
- Disclosed