Vulnerability-Lookup

CVE-2026-53523 (GCVE-0-2026-53523)

Vulnerability from cvelistv5 – Published: 2026-06-12 21:04 – Updated: 2026-06-15 21:35

Title

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Summary

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-15 21:35 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/nezhahq/nezha/security/advisor…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
nezhahq	nezha	Affected: >= 1.0.0, < 2.2.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53523",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T21:35:11.641888Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T21:35:45.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nezha",
          "vendor": "nezhahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request\u0027s Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-12T21:04:46.741Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
        }
      ],
      "source": {
        "advisory": "GHSA-9rc6-8cjv-rcvx",
        "discovery": "UNKNOWN"
      },
      "title": "Nezha Monitoring: OAuth2 Redirect URL \u2014 Host Header Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53523",
    "datePublished": "2026-06-12T21:04:46.741Z",
    "dateReserved": "2026-06-09T17:30:33.456Z",
    "dateUpdated": "2026-06-15T21:35:45.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53523",
      "date": "2026-09-17",
      "epss": "0.00239",
      "percentile": "0.15217"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "nezha",
                "vendor": "nezhahq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.0.0, \u003c 2.2.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request\u0027s Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0."
          }
        ],
        "id": "CVE-2026-53523",
        "lastModified": "2026-06-17T10:57:57.843",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.6,
              "impactScore": 5.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-53523",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T21:35:11.641888Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-12T22:16:52.523",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-30T16:41:12Z",
      "cve": "CVE-2026-53523",
      "id": "CVE-2026-53523",
      "initial_release_date": "2026-07-30T16:41:12Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53523",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53523.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-53523",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-15T21:35:11.641888Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-15T21:35:35.643Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "nezha",
              "vendor": "nezhahq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.0.0, \u003c 2.2.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request\u0027s Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-601",
                  "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-12T21:04:46.741Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
            }
          ],
          "source": {
            "advisory": "GHSA-9rc6-8cjv-rcvx",
            "discovery": "UNKNOWN"
          },
          "title": "Nezha Monitoring: OAuth2 Redirect URL \u2014 Host Header Injection"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-53523",
        "datePublished": "2026-06-12T21:04:46.741Z",
        "dateReserved": "2026-06-09T17:30:33.456Z",
        "dateUpdated": "2026-06-15T21:35:45.175Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-53523

Vulnerability from fkie_nvd - Published: 2026-06-12 22:16 - Updated: 2026-06-17 10:57

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "nezha",
          "vendor": "nezhahq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0.0, \u003c 2.2.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request\u0027s Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0."
    }
  ],
  "id": "CVE-2026-53523",
  "lastModified": "2026-06-17T10:57:57.843",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-53523",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-15T21:35:11.641888Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-12T22:16:52.523",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9RC6-8CJV-RCVX

Vulnerability from github – Published: 2026-06-26 23:05 – Updated: 2026-06-26 23:05

Summary

Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Details

1. Description

The getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header:

func getRedirectURL(c *gin.Context) string {
    scheme := "http://"
    referer := c.Request.Referer()
    if forwardedProto := c.Request.Header.Get("X-Forwarded-Proto"); forwardedProto == "https" || strings.HasPrefix(referer, "https://") {
        scheme = "https://"
    }
    return scheme + c.Request.Host + "/api/v1/oauth2/callback"
}

File: cmd/dashboard/controller/oauth2.go:22-29

This function is called from oauth2redirect() at line 53:

func oauth2redirect(c *gin.Context) (*model.Oauth2LoginResponse, error) {
    // ...
    redirectURL := getRedirectURL(c)
    o2conf := o2confRaw.Setup(redirectURL)
    // ...
    url := o2conf.AuthCodeURL(state, oauth2.AccessTypeOnline)
    return &model.Oauth2LoginResponse{Redirect: url}, nil
}

The redirectURL is passed into o2confRaw.Setup(redirectURL) which configures the OAuth2 Config.RedirectURL field (oauth2config.go:22-33). This RedirectURL is sent to the OAuth2 provider (e.g., GitHub, Google, Microsoft) as the callback endpoint. The OAuth2 provider will redirect the user's browser — along with the authorization code — to this URL after the user authenticates.

The security issue is that c.Request.Host is directly user-controllable via the HTTP Host header. An attacker who can control which Host header reaches the oauth2redirect handler can:

Set Host: evil.com
getRedirectURL returns https://evil.com/api/v1/oauth2/callback
The OAuth2 provider redirects the victim's auth code to evil.com
The attacker's server at evil.com captures the auth code
The attacker exchanges the code for an access token, binding the victim's OAuth identity to the attacker's dashboard account

The scheme detection (lines 24-27) uses X-Forwarded-Proto and the Referer header, both of which are also user-controllable in certain configurations, so the attacker can force https:// scheme in the redirect URL.

The oauth2callback handler at line 129 later uses state.RedirectURL (which is stored in singleton.Cache at line 65) when calling exchangeOpenId at line 152. The cached redirectURL was set during the initial oauth2redirect call, tying the attack flow together.

2. PoC

A conceptual attack (no Docker needed):

Scenario: OAuth2 provider has loose redirect URI validation
          (e.g., allows wildcard subdomain matching)

1. Attacker crafts a URL to the dashboard's OAuth2 login endpoint
   with a modified Host header:

   GET /api/v1/oauth2/github HTTP/1.1
   Host: attacker-controlled.com
   X-Forwarded-Proto: https

2. The dashboard responds with a redirect to:
   https://github.com/login/oauth/authorize?client_id=...&redirect_uri=https://attacker-controlled.com/api/v1/oauth2/callback&state=...

3. Victim clicks the attacker's link → authenticates with GitHub
   → GitHub redirects to https://attacker-controlled.com/api/v1/oauth2/callback?code=AUTH_CODE&state=...

4. Attacker captures the AUTH_CODE from their server logs

5. Attacker exchanges the code at the real dashboard's
   /api/v1/oauth2/callback endpoint (using the real Host header
   this time), binding the victim's OAuth identity to their
   dashboard account

Prerequisites for full exploit: - The victim must click the attacker's crafted link - The OAuth2 provider must accept the attacker's domain as a valid redirect URI (some providers accept https://*/* or allow wildcards; others are strict)

3. Impact

Account takeover: an attacker who intercepts the OAuth2 authorization code can bind the victim's OAuth identity (GitHub, Google, GitLab, etc.) to their own dashboard account, gaining the victim's access level and permissions
Privilege escalation: if the victim is an admin, the attacker gains full administrative control over the Nezha deployment — access to all servers, credentials, and configuration
Persistence: once bound, the attacker retains access even if the victim resets their password (unless they also unbind the OAuth2 identity)

The attack complexity is higher than typical Host header injection scenarios because it requires: 1. The Host header to reach the dashboard's handler unmodified (bypassing reverse proxy normalization) 2. The OAuth2 provider to have loose redirect URL validation 3. User interaction (the victim must authenticate)

However, the code-level vulnerability is unambiguous: the application trusts attacker-controlled input (Host header) for a security-critical URL that participates in the OAuth2 authorization code flow.

4. Remediation

Validate the Host header against a configured allowlist of known dashboard hostnames: go func getRedirectURL(c *gin.Context) string { host := c.Request.Host if !singleton.Conf.IsAllowedHost(host) { host = singleton.Conf.DashboardBaseURL // fallback } // ... }
Pin the redirect URL to the configured dashboard URL from singleton.Conf instead of deriving it from the request Host header: go func getRedirectURL(c *gin.Context) string { return singleton.Conf.DashboardBaseURL + "/api/v1/oauth2/callback" }
Remove Host header-based URL construction entirely — the OAuth2 redirect URL should be deterministic based on server configuration, not dynamic per-request
Add Host header validation middleware for all OAuth2-related endpoints as defense-in-depth

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/nezhahq/nezha"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53523"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T23:05:19Z",
    "nvd_published_at": "2026-06-12T22:16:52Z",
    "severity": "MODERATE"
  },
  "details": "## 1. Description\n\nThe `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenating the request\u0027s `Host` header with a fixed path, with **zero validation** of the Host header:\n\n```go\nfunc getRedirectURL(c *gin.Context) string {\n    scheme := \"http://\"\n    referer := c.Request.Referer()\n    if forwardedProto := c.Request.Header.Get(\"X-Forwarded-Proto\"); forwardedProto == \"https\" || strings.HasPrefix(referer, \"https://\") {\n        scheme = \"https://\"\n    }\n    return scheme + c.Request.Host + \"/api/v1/oauth2/callback\"\n}\n```\n\n**File:** `cmd/dashboard/controller/oauth2.go:22-29`\n\nThis function is called from `oauth2redirect()` at line 53:\n```go\nfunc oauth2redirect(c *gin.Context) (*model.Oauth2LoginResponse, error) {\n    // ...\n    redirectURL := getRedirectURL(c)\n    o2conf := o2confRaw.Setup(redirectURL)\n    // ...\n    url := o2conf.AuthCodeURL(state, oauth2.AccessTypeOnline)\n    return \u0026model.Oauth2LoginResponse{Redirect: url}, nil\n}\n```\n\nThe `redirectURL` is passed into `o2confRaw.Setup(redirectURL)` which configures the OAuth2 `Config.RedirectURL` field (`oauth2config.go:22-33`). This `RedirectURL` is sent to the OAuth2 provider (e.g., GitHub, Google, Microsoft) as the callback endpoint. The OAuth2 provider will redirect the user\u0027s browser \u2014 along with the authorization code \u2014 to this URL after the user authenticates.\n\nThe security issue is that `c.Request.Host` is directly user-controllable via the HTTP `Host` header. An attacker who can control which Host header reaches the oauth2redirect handler can:\n\n1. Set `Host: evil.com`\n2. `getRedirectURL` returns `https://evil.com/api/v1/oauth2/callback`\n3. The OAuth2 provider redirects the victim\u0027s auth code to `evil.com`\n4. The attacker\u0027s server at `evil.com` captures the auth code\n5. The attacker exchanges the code for an access token, binding the victim\u0027s OAuth identity to the attacker\u0027s dashboard account\n\nThe scheme detection (lines 24-27) uses `X-Forwarded-Proto` and the `Referer` header, both of which are also user-controllable in certain configurations, so the attacker can force `https://` scheme in the redirect URL.\n\nThe `oauth2callback` handler at line 129 later uses `state.RedirectURL` (which is stored in `singleton.Cache` at line 65) when calling `exchangeOpenId` at line 152. The cached `redirectURL` was set during the initial `oauth2redirect` call, tying the attack flow together.\n\n## 2. PoC\n\nA conceptual attack (no Docker needed):\n\n```\nScenario: OAuth2 provider has loose redirect URI validation\n          (e.g., allows wildcard subdomain matching)\n\n1. Attacker crafts a URL to the dashboard\u0027s OAuth2 login endpoint\n   with a modified Host header:\n\n   GET /api/v1/oauth2/github HTTP/1.1\n   Host: attacker-controlled.com\n   X-Forwarded-Proto: https\n\n2. The dashboard responds with a redirect to:\n   https://github.com/login/oauth/authorize?client_id=...\u0026redirect_uri=https://attacker-controlled.com/api/v1/oauth2/callback\u0026state=...\n\n3. Victim clicks the attacker\u0027s link \u2192 authenticates with GitHub\n   \u2192 GitHub redirects to https://attacker-controlled.com/api/v1/oauth2/callback?code=AUTH_CODE\u0026state=...\n\n4. Attacker captures the AUTH_CODE from their server logs\n\n5. Attacker exchanges the code at the real dashboard\u0027s\n   /api/v1/oauth2/callback endpoint (using the real Host header\n   this time), binding the victim\u0027s OAuth identity to their\n   dashboard account\n```\n\n**Prerequisites for full exploit:**\n- The victim must click the attacker\u0027s crafted link\n- The OAuth2 provider must accept the attacker\u0027s domain as a valid redirect URI (some providers accept `https://*/*` or allow wildcards; others are strict)\n\n## 3. Impact\n\n- **Account takeover**: an attacker who intercepts the OAuth2 authorization code can bind the victim\u0027s OAuth identity (GitHub, Google, GitLab, etc.) to their own dashboard account, gaining the victim\u0027s access level and permissions\n- **Privilege escalation**: if the victim is an admin, the attacker gains full administrative control over the Nezha deployment \u2014 access to all servers, credentials, and configuration\n- **Persistence**: once bound, the attacker retains access even if the victim resets their password (unless they also unbind the OAuth2 identity)\n\nThe attack complexity is higher than typical Host header injection scenarios because it requires:\n1. The `Host` header to reach the dashboard\u0027s handler unmodified (bypassing reverse proxy normalization)\n2. The OAuth2 provider to have loose redirect URL validation\n3. User interaction (the victim must authenticate)\n\nHowever, the code-level vulnerability is unambiguous: the application trusts attacker-controlled input (`Host` header) for a security-critical URL that participates in the OAuth2 authorization code flow.\n\n## 4. Remediation\n\n1. **Validate the Host header** against a configured allowlist of known dashboard hostnames:\n   ```go\n   func getRedirectURL(c *gin.Context) string {\n       host := c.Request.Host\n       if !singleton.Conf.IsAllowedHost(host) {\n           host = singleton.Conf.DashboardBaseURL // fallback\n       }\n       // ...\n   }\n   ```\n\n2. **Pin the redirect URL** to the configured dashboard URL from `singleton.Conf` instead of deriving it from the request Host header:\n   ```go\n   func getRedirectURL(c *gin.Context) string {\n       return singleton.Conf.DashboardBaseURL + \"/api/v1/oauth2/callback\"\n   }\n   ```\n\n3. **Remove Host header-based URL construction** entirely \u2014 the OAuth2 redirect URL should be deterministic based on server configuration, not dynamic per-request\n\n4. **Add Host header validation middleware** for all OAuth2-related endpoints as defense-in-depth",
  "id": "GHSA-9rc6-8cjv-rcvx",
  "modified": "2026-06-26T23:05:19Z",
  "published": "2026-06-26T23:05:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53523"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nezhahq/nezha"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nezha Monitoring: OAuth2 Redirect URL \u2014 Host Header Injection"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-53523 (GCVE-0-2026-53523)

FKIE_CVE-2026-53523

GHSA-9RC6-8CJV-RCVX

1. Description

2. PoC

3. Impact

4. Remediation

Tags

Sightings

Nomenclature

Related by attack behaviour