A vulnerability in Nextcloud Server allows an attacker who knows a user’s password to bypass two‑factor authentication by reusing a transient session token. During the normal login flow a temporary token is created before the second factor challenge, and that token can be extracted and replayed with HTTP Basic Authentication, granting the attacker access to authenticated resources without being challenged for the second factor. The weakness is an authentication bypass (CWE‑287).

The flaw affects Nextcloud Server community versions 32.0.0 through 32.0.8 and 33.0.0 through 33.0.2. For Nextcloud Enterprise Server the vulnerable releases are 31.0.14.5, 30.0.17.9, 29.0.16.16, 32.0.9 and 33.0.3. The advisory recommends upgrading to any of the patched releases 32.0.9 or 33.0.3 for the community edition, and to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9 or 29.0.16.16 for the Enterprise edition.

The CVSS score of 5.9 indicates a moderate severity, and the advisory is not listed in the CISA KEV catalog. The exploitation pathway requires an attacker to possess valid user credentials and to obtain or guess the temporary session token that is issued during the standard login flow. Once the token is replayed via HTTP Basic Authentication, the attacker can access any authenticated endpoint with the privileges of the target user. Because the vulnerability hinges on profile credentials and network traffic interception, remote attackers who can reach the web interface or attackers with compromised credentials pose the greatest threat. The absence of an EPSS score means the current likelihood of exploitation is uncertain, but the moderate CVSS score suggests that once the flaw is known, it could be leveraged in targeted attacks.