Insufficiently Protected Credentials (CWE-522)CVSS 4.2€235
Credential Disclosure via Unvalidated directDownloadUrl (Missing DontAddCredentialsAttribute)
py0zz1
Disclosed on HackerOne · April 13, 2026
Publicly disclosed report · by py0zz1
View original on HackerOneSummary:
The Nextcloud Desktop Client automatically includes user credentials (Authorization header with username:password in Base64) when downloading files via the directDownloadUrl feature. A malicious Nextcloud server can exploit this by setting directDownloadUrl to an attacker-controlled URL, causing the client to leak credentials to the attacker's server.
Root Cause: The client fails to validate the origin of directDownloadUrl and does not set DontAddCredentialsAttribute for cross-origin requests, allowing HttpCredentialsAccessManager to automatically inject Authorization headers to any URL specified by the server, including attacker-controlled domains.