CVE-2026-45690 is an improper authentication vulnerability (CWE-287) in Nextcloud Server that affects versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3. The flaw allows an attacker with knowledge of a user's password to bypass two-factor authentication by exploiting the creation of a temporary session token prior to 2FA enforcement. This token can be extracted and replayed using HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. The vendor recommends upgrading to fixed versions 32.0.9, 33.0.3, or specific Enterprise Server versions to remediate the issue.

An attacker who knows a valid user's password can bypass the two-factor authentication mechanism, potentially gaining unauthorized access to user accounts and sensitive data. The vulnerability impacts the confidentiality and integrity of the affected Nextcloud Server instances but does not affect availability. There are no known exploits in the wild at this time.

A fix is available by upgrading Nextcloud Server to version 32.0.9 or 33.0.3. For Nextcloud Enterprise Server, upgrade to versions 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16. Since the vendor advisory explicitly recommends these upgrades, applying these official fixes is the primary mitigation. Patch status is confirmed by the vendor's recommended upgrade versions.