CVE-2026-45278 is an open redirect vulnerability (CWE-601) affecting Nextcloud security-advisories versions 6.1.0 through before 8.2.2. The flaw allows an attacker to create specially crafted links that redirect users to arbitrary external websites during the user OIDC login process. This could potentially be used in phishing or social engineering attacks to redirect users to malicious sites. The vulnerability was patched in Nextcloud version 8.2.2.

The vulnerability does not impact confidentiality or availability but allows limited integrity impact by redirecting users to untrusted sites. This could facilitate phishing attacks or trick users into interacting with malicious websites. There is no indication of exploitation in the wild.

Upgrade Nextcloud to version 8.2.2 or later, where this open redirect vulnerability has been patched. Since the vendor advisory confirms the fix in 8.2.2, applying this official update fully mitigates the issue.