Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Priority HIGH 65CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed nezha (nezhahq): 2.2.0github.com/nezhahq/nezha (Go): 2.2.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nezhahq | nezha | 1.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
| — | github.com/nezhahq/nezha (Go) | 1.0.0 to before 2.2.0 | 2.2.0 | Patch available | GHSA-9rc6-8cjv-rcvx |
- nezha Vendornezhahq Affected 1.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
- github.com/nezhahq/nezha (Go) Vendor— Affected 1.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-9rc6-8cjv-rcvx
Remediation
- Fix · CNA nezha (nezhahq) Fixed in 2.2.0
- Fix · GHSA-9rc6-8cjv-rcvx github.com/nezhahq/nezha (Go) Fixed in 2.2.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-53523
- 2026-10-03 Alias added: GHSA-9rc6-8cjv-rcvx
References
More nezhahq vulnerabilities
- TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
- TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
- TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
- TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
- TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1
- TI-2026-67488 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock CVSS 4.0HIGH 7.1
Sources
- CVE-2026-53523 · CVE Program
- CVE-2026-53523 · NVD
- FIRST EPSS
- GHSA-9rc6-8cjv-rcvx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences