Post cover image
by ChatGpt

June 23, 2026

I Found a 0-Day in Nextcloud… But Couldn’t Find One in a Fake Heart 💔🔓

CVE-2026–45156 | $2,500 Bounty | Critical Auth Bypass

By CyberTechAjju

7 min read

"Main systems mein 0-day dhundh leta hoon… lekin ek insaan ke dil mein chal raha deception nahi detect kar saka."

Author: CyberTechAjju CVE: CVE-2026–45156 · Advisory: GHSA-qqgv-fqwp-mjpp · HackerOne: #3489490

None

🎧 2 AM. Wednesday. Winter.

Picture this.

Winter. The kind where your fingers freeze on the keyboard but your brain refuses to sleep. It's 2 AM on a Wednesday — because that's how I roll. Wednesday nights = full night hunt mode. Sleep the entire Thursday like a dead process. Repeat weekly.

Headphones on. Arijit Singh sad mashup playing on loop — you know the one. "Tum Hi Ho" fading into "Channa Mereya" fading into "Phir Bhi Tumko Chaahunga."

The irony? At this point, I hadn't been through any breakup. I just vibed to Arijit because his voice hits different at 2 AM in a cold night. I thought I understood those songs. I thought the lyrics were just poetry.

Bhai, kuch mahine baad pata chala — wo poetry nahi thi. Wo prophecy thi. 💀

Every. Single. Lyric. Started making painful, surgical sense. But that heartbreak chapter comes later.

Right now, at 2 AM, wrapped in a rajaii, Arijit crying in my ears, eyes glued to PHP source code — I'm about to find a Critical 0-day in Nextcloud.

🧠 The Bug — Explained Like You're 5

What's a JWT?

Think of a JWT like a movie ticket:

┌────────────┬──────────────────┬───────────────┐
│  HEADER    │     PAYLOAD      │  SIGNATURE    │
│  Theater   │  Your seat, name │  Hologram     │
│  info      │  show time       │  PROOF it's   │
│            │                  │  REAL         │
└────────────┴──────────────────┴───────────────┘

The signature is the hologram — it proves the ticket wasn't printed on your home printer.

What Nextcloud Did:

They checked the seat number… but never looked at the hologram. 🤦

// Split the ticket into parts
[$header, $payload, $signature] = explode('.', $token);

// Read the seat number directly
$plainPayload = json_decode(base64_decode($payload), true);

// THE DEVELOPER LITERALLY WROTE THIS:
/** TODO: VALIATE SIGNATURE! */
//                ^^ they even misspelled "VALIDATE" lmao

// Used the unverified name to log in the user
$backendUser = $userMapper->getOrCreate(..., $plainPayload['sub']);

The developer wrote a TODO to verify signatures. Then shipped it. And went home. 💀

🗺️ Mind Map — The Whole Vulnerability

None

💀 The Exploit — 4 Simple Steps

None

The Forged Token:

header  = {"alg": "none", "typ": "JWT"}    # No signature algorithm
payload = {"sub": "admin", "exp": 9999999999}  # I'm the admin now
token   = base64(header) + "." + base64(payload) + "."
#                                                    ↑
#                                          Signature = NOTHINGp

That's it. A 5-line Python script to become admin on any Nextcloud with ID4me enabled.

The Full Attack:

 You (attacker) → own evil.com
                → set DNS to point to your OIDC server
                → enter "admin@evil.com" on Nextcloud login
                → Nextcloud contacts your server
                → you return forged JWT {"sub": "admin"}
                → Nextcloud does base64_decode(), trusts it
                → you're admin. GG. 🎮

🚀 Automated PoC Exploit

I've written a fully weaponized Python script that automates this entire flow (detects Nextcloud, extracts CSRF, starts a fake OIDC server, creates an Ngrok tunnel, and fires the forged token).

You can find the full script on my GitHub: 🔗 CVE-2026–45156 PoC Exploit Repository

(Note: For authorized bug bounty testing only.)

🔧 The Fix (6 Lines vs 4 Broken Ones)

- [$header, $payload, $signature] = explode('.', $data['id_token']);
- $plainPayload = json_decode(base64_decode($payload), true);
- /** TODO: VALIATE SIGNATURE! */

+ use Firebase\JWT\JWT;
+ use Firebase\JWT\JWK;
+ $keys = JWK::parseKeySet(json_decode(file_get_contents($jwksUri), true));
+ $plainPayload = (array) JWT::decode($data['id_token'], $keys);

4 lines broke it. 4 lines fixed it.

📊 Stats

None

💔 The Real Exploit Was on Me

Now the part I didn't plan on writing. But life said "bhai, blog mein masala bhi chahiye."

When I found this bug, my HackerOne account was out of signal. I needed to report fast. So I asked someone I deeply trusted — my partner, my "collaborator" — to submit it from her account. I wrote the entire report. Every word, every code snippet, every reproduction step. She clicked Submit. I joined as collaborator.

$2,500 bounty came in. Split between us. All good, right?

Ha ha. No.

The Promises

She made promises. Not just regular promises — we're talking more promises than a Zero Trust Architecture has verification layers. "I'll never break your trust." "You're the only one." "I'm interested in hacking too!" "We'll grow together."

Bro, a Zero Trust model operates on "never trust, always verify." But her promises? They operated on "always trust me, never verify." And like the idiot I am, I implemented the wrong security model for my heart. 🤡

The Reality

While I was reversing auth flows at 2 AM in freezing cold…

  • She was having spicy conversations with other guys — the kind that would make even an alg: none JWT blush 🫣
  • Taking "classes" from people who literally followed me — tu imagine kar, mere followers se "padhai" 😂
  • Her hobbies changed more frequently than a load balancer rotates servers — one day hacking interested her, next day someone else interested her. Hobby change karna hi uski real hobby thi
  • She said she loved hacking. Turns out, the only thing she was hacking was my trust 💀

The Pattern Match

You know what's funny? Before her, I thought "2–3 relationships didn't work out, maybe I'm the problem." After her, the real vulnerability was patched — from my brain:

"It wasn't a bug in me. It was a feature in them."

She lied about her interests to get close. Faked her passions. Pretended to care about my world. Classic social engineering — build rapport, gain trust, extract value, pivot to next target.

I've seen this attack pattern in CTFs. I just never expected it from someone sleeping next to me.

The Arijit Singh Moment

Remember that Arijit Singh sad mashup I was vibing to on that winter night? Back then, "Channa Mereya" was just a nice melody. "Tum Hi Ho" was just background music for coding.

Now? Now every line of those songs hits like a SIGSEGV — straight crash, no recovery. Arijit wasn't singing songs. He was writing debug logs for my future. 😭😂

Maine socha tha wo gaane bas sunne ke liye hain… Pata nahi tha life mein implement bhi honge. 💔

The Verdict

Her commitment_token had alg: none. No signature. No integrity. No verification. And I accepted it like Nextcloud accepted my forged JWT — blindly.

She made more promises than a Zero Trust whitepaper… and broke more than a script kiddie's first exploit.

But here's the thing about forged people — they get invalidated eventually. Mine did. ✌️

🖤 Why Real Hackers Stay Single

I'm going to say something controversial:

The best hackers I know are single. Not because they can't find someone — but because they learned that human.trust() has the worst vulnerability disclosure program.

Think about it:

| Hacking                          | Relationships                       |
|----------------------------------|-------------------------------------|
| Find bug → report → get bounty   | Find red flag → ignore → get burned |
| Zero Trust Architecture          | Zero Trust... but still trusted     |
| Exploits get patched             | Toxic people don't                  |
| CVE stays forever in NVD         | "I love you" gets deleted           |
| Source code doesn't lie          | People absolutely do                |

_Main ye nahi keh raha ki pyar mat karo. Main ye keh raha hoon — _pehle khud ko itna valuable banao ki tumhe dhokha dene waale ko regret ho.

And that's exactly what happened. She has screenshots and drama. I have a CVE in the National Vulnerability Database. 😎

📝 Lessons (Hacking + Life)

For Your Terminal:

  1. Read TODO comments — Developers confess their sins in them
  2. base64_decode() ≠ security — If JWTs are decoded manually, that's your 0-day
  3. Test optional features — ID4me was a forgotten corner. Best bugs hide in forgotten corners
  4. Source code review > scanners — No tool found this. My eyes at 2 AM with Arijit in my ears did
  5. explode('.', $jwt) = red flag — If you see this, start writing your report

For Your Heart:

  1. Your account. Your report. Always. — Never submit your work from someone else's profile. EVER.
  2. Implement Zero Trust in life too — Not just in your architecture. Verify people's actions, not their words
  3. If someone changes hobbies faster than you change branches — that's not a personality, that's social engineering 🚩
  4. Promises without proof = alg: none — Anyone can say anything. Signature kahan hai?
  5. Real hackers don't need validation from people — Your CVE validates you. NVD validates you. Your skills validate you. Not someone's "I love you" at midnight
  6. Breakups heal. CVEs are permanent. — She'll forget you. But CVE-2026-45156 will be in NVD till the internet dies
  7. Stay single until someone matches your energy — Not your followers. Not your bounties. YOUR ENERGY.

🔗 Links

💬 Quotes I Live By Now

"Forged tokens get invalidated eventually. And so do fake people."

"She promised more than a Zero Trust whitepaper… and delivered less than a TODO comment."

"I couldn't find the 0-day in her heart because she was running a completely different OS than what she advertised."

"Arijit Singh isn't a singer. He's a vulnerability scanner for the heart. And my scan results came back CRITICAL."

"Real hackers don't cry over breakups. They open their laptop and find the next CVE. The NVD remembers you longer than any person ever will."

👨‍💻 About Me

CyberTechAjju — Bug Bounty Hunter · Security Researcher · 🐙 GitHub · 🏆 CVE-2026–45156 · 🔗Linkedin

Finding 0-days in systems since winter nights. Learning to find them in people since heartbreak. Currently single. Not because I can't find someone — but because my vulnerability scanner for humans is still in beta. 😂 If this helped you learn something — about hacking or about life — share it with a fellow hacker. And remember: always verify signatures. In JWT tokens… and in people who say "I love you." 🔐💔