Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Nezha can let forged host hijack OAuth login

published 21 days ago

Summary

Nezha version 2.2.3 may use a web address supplied by an attacker when the optional dashboard host setting is left blank. This can cause a victim’s login to be redirected to a site controlled by the attacker, allowing the attacker to capture the login credentials. Update to a fixed version as soon as it is released or ensure the dashboard host setting is properly configured.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Go	nezhahq	github.com/nezhahq/nezha	All versions

Original advisory text

Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches Nezha with a forged Host header can cause an attacker-controlled callback URL to be used as the redirect_uri; if the OAuth2 provider accepts it, the victim's authorization code is delivered to the attacker origin, allowing the attacker to complete the OAuth2 login/binding flow and take over the account. This regresses the fix for GHSA-9rc6-8cjv-rcvx and is configuration-dependent (dashboard_host empty). At the time of the advisory no patched version was available.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.3 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-601Open Redirect

Timeline

Published27 Sep 2026

Updated30 Sep 2026

First seen15 Sep 2026

Sources

GHSA-rf68-8gjr-36q7 · OSV

Track software like this

Free during beta