CVE-2026-84473

Summary

An authentication bypass and missing brute-force protection in ownCloud server 10.16.3 allows unauthenticated attackers to repeatedly submit HTTP Basic Authentication requests to the WebDAV endpoint (remote.php/webdav/) without rate limiting, enabling unlimited online password guessing.

Exploitability

Exploitation is trivial for any remote attacker with network access to the WebDAV endpoint; no authentication or special conditions are required.

Blast radius

Successful exploitation could lead to full account compromise of any WebDAV user, resulting in unauthorized access to sensitive files, data modification, and potential system takeover depending on user privileges.

Detection

Defenders should monitor HTTP access logs for repeated 401 Unauthorized responses from /remote.php/webdav/ originating from the same source IP within a short time window (e.g., >10 requests/minute), especially with identical or sequential credential attempts; elevated 401 frequency without corresponding user activity is highly suspicious.

Prioritized remediation

Upgrade to ownCloud server version 10.16.4 or later, which includes fixes for authentication rate limiting and WebDAV endpoint hardening.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.