WhatBrokeToday
Today's Trends
criticalInvestigatingPHPv10.16.3

ownCloud Server 10.16.3 WebDAV Endpoint Vulnerable to Authentication Bypass

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

An authentication bypass and missing brute-force protection vulnerability in remote.php/webdav/ of ownCloud server 10.16.3 allows unauthenticated remote attackers to perform unlimited password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Missing brute-force protection and authentication bypass in the WebDAV endpoint (remote.php/webdav/) of ownCloud server.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    remote.php/webdav/ in ownCloud ownCloud server 10.16.3: CVE-2026-84473 (Critical)(opens security advisory in a new tab)

    Critical severity. Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentication requests to the WebDAV endpoint.

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    remote.php/webdav/ in ownCloud ownCloud server 10.16.3: CVE-2026-84473 (Critical)

    Source