CVE-2026-45691 describes an authentication bypass vulnerability in Nextcloud Server where session cookies issued before two-factor authentication (2FA) completion can be reused as Bearer tokens to access DAV endpoints. This flaw allows attackers to circumvent mandatory 2FA protections and gain read/write access to resources via DAV. The issue affects Nextcloud Server versions from 32.0.0 up to but not including 32.0.9, and from 33.0.0 up to but not including 33.0.3. No official remediation level or patch information is provided in the available data.

An attacker who obtains a pre-2FA session cookie can reuse it as a Bearer token to bypass mandatory two-factor authentication and gain unauthorized read/write access to DAV endpoints on the affected Nextcloud Server versions. This compromises the integrity and confidentiality of data accessible via these endpoints. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to DAV endpoints and monitor for suspicious use of session tokens. Avoid using affected versions or upgrade to versions 32.0.9 or later and 33.0.3 or later once confirmed by the vendor.