CVE-2026-45156 is an improper authentication vulnerability (CWE-287) in Nextcloud's User OIDC integration affecting multiple version ranges before 3.1.0, 5.1.0, and 6.4.0. The root cause is missing signature verification of OIDC tokens, which allows a malicious ID4me authority to impersonate any user. This flaw compromises confidentiality and integrity by enabling unauthorized user impersonation without requiring privileges. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1 (network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality and integrity impact, no availability impact). Fixed versions include 3.1.0, 4.1.0, 5.1.0, 6.4.0, and 8.3.0. No vendor advisory text is provided to confirm patch availability or mitigation details beyond version updates.

Successful exploitation allows a malicious ID4me authority to impersonate any user in affected Nextcloud versions, leading to unauthorized access to user accounts and potentially sensitive data. The impact affects confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported at this time.

Upgrade to Nextcloud versions 3.1.0, 4.1.0, 5.1.0, 6.4.0, or 8.3.0 or later, which include patches for this vulnerability. Patch status is not explicitly confirmed in the vendor advisory content provided, but the fixed versions indicate an official fix is available. Users should apply these updates promptly to mitigate the risk of impersonation attacks via the User OIDC component.