Nextcloud · disclosed reports
Authentication
70 disclosed reports · $12,050 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Nextcloud on HackerOne- reports
- 70
- paid a bounty
- 20
Every one of the 70 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Attacker can obtain write access to any federated share/public link
- PIN bypass in PassCodeActivity via back button
- Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
- Basic auth header on WebDAV requests is not bruteforce protected
- Password reset endpoint is not brute force protected
- Approval app allows users to request approval for other users file
- Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
- 2FA Session not expires after the password reset
- Brute force protection allows to send more requests than intended
- App PIN code can be bypassed in Files iOS
- Bruteforce protection in password verification can be bypassed
- Ability to by-pass second factor
- Password of talk conversations can be bruteforced
- Missing brute force protection on password confirmation modal
- Cross-User Lock/Unlock via Absolute DAV Path
- Improper restriction of excessive authentication attempts on WebDAV endpoint
- Session fixation on public talk links
- Ratelimiting can be bypassed using IPv6 subnets
- Possible denial of service when entering a loooong password
- Lack of bruteforce protection for TOTP 2FA
- Missing brute force protection on OAuth2 API controller
- bypass of 2FA
- Session fixation in password protected public download.
- Memcached used as RateLimiter backend is no-op
- Authentication Issue
- App pin of the Android app can be bypassed via 3rdparty apps generating deep links
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.