{"id":"EUVD-2026-36602","revision":null,"records":[{"revision":"09cff566192d4f3aacc9e701d5ecd572","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-53523","aliases":[],"title":"Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.","state":0,"publishedAt":"2026-06-12T21:04:46.741+00:00","modifiedAt":"2026-06-15T21:35:45.175+00:00","affected":[{"ecosystem":"Vendor product","name":"nezha","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nezhahq\",\n                    \"product\": \"nezha\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 2.2.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53523","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-53523","identifiers":["CVE-2026-53523"]},"retained":false,"historicalAffected":[]},{"revision":"38288684768d44f59a495fa07751e4da","observedAt":"2026-11-07T11:37:41.416+00:00","statement":{"source":"euvd","id":"EUVD-2026-36602","aliases":["CVE-2026-53523","GHSA-9rc6-8cjv-rcvx"],"title":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating t…","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":null}],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36602","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 12, 2026, 9:04:46 PM","dateUpdated":"Jun 15, 2026, 9:35:45 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36602","identifiers":["EUVD-2026-36602","CVE-2026-53523","GHSA-9rc6-8cjv-rcvx"]},"retained":false,"historicalAffected":[]},{"revision":"d2b32ed8ab56432aade47db10ea15948","observedAt":"2026-10-27T14:13:22.737+00:00","statement":{"source":"nvd","id":"CVE-2026-53523","aliases":[],"title":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating t…","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.","state":0,"publishedAt":"2026-06-12T22:16:52.523+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":6.8,"severity":"MEDIUM"}],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53523","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-601"],"productCriteria":[],"sourceDates":{"published":"2026-06-12T22:16:52.523","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-53523","identifiers":["CVE-2026-53523"]},"retained":false,"historicalAffected":[]},{"revision":"75a84a740f444149a89b525139e06b5b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-9rc6-8cjv-rcvx","aliases":["CVE-2026-53523","GO-2026-5829"],"title":"Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection","description":"## 1. Description\n\nThe `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenating the request's `Host` header with a fixed path, with **zero validation** of the Host header:\n\n```go\nfunc getRedirectURL(c *gin.Context) string {\n    scheme := \"http://\"\n    referer := c.Request.Referer()\n    if forwardedProto := c.Request.Header.Get(\"X-Forwarded-Proto\"); forwardedProto == \"https\" || strings.HasPrefix(referer, \"https://\") {\n        scheme = \"https://\"\n    }\n    return scheme + c.Request.Host + \"/api/v1/oauth2/callback\"\n}\n```\n\n**File:** `cmd/dashboard/controller/oauth2.go:22-29`\n\nThis function is called from `oauth2redirect()` at line 53:\n```go\nfunc oauth2redirect(c *gin.Context) (*model.Oauth2LoginResponse, error) {\n    // ...\n    redirectURL := getRedirectURL(c)\n    o2conf := o2confRaw.Setup(redirectURL)\n    // ...\n    url := o2conf.AuthCodeURL(state, oauth2.AccessTypeOnline)\n    return &model.Oauth2LoginResponse{Redirect: url}, nil\n}\n```\n\nThe `redirectURL` is passed into `o2confRaw.Setup(redirectURL)` which configures the OAuth2 `Config.RedirectURL` field (`oauth2config.go:22-33`). This `RedirectURL` is sent to the OAuth2 provider (e.g., GitHub, Google, Microsoft) as the callback endpoint. The OAuth2 provider will redirect the user's browser — along with the authorization code — to this URL after the user authenticates.\n\nThe security issue is that `c.Request.Host` is directly user-controllable via the HTTP `Host` header. An attacker who can control which Host header reaches the oauth2redirect handler can:\n\n1. Set `Host: evil.com`\n2. `getRedirectURL` returns `https://evil.com/api/v1/oauth2/callback`\n3. The OAuth2 provider redirects the victim's auth code to `evil.com`\n4. The attacker's server at `evil.com` captures the auth code\n5. The attacker exchanges the code for an access token, binding the victim's OAuth identity to the attacker's dashboard account\n\nThe scheme detection (lines 24-27) uses `X-Forwarded-Proto` and the `Referer` header, both of which are also user-controllable in certain configurations, so the attacker can force `https://` scheme in the redirect URL.\n\nThe `oauth2callback` handler at line 129 later uses `state.RedirectURL` (which is stored in `singleton.Cache` at line 65) when calling `exchangeOpenId` at line 152. The cached `redirectURL` was set during the initial `oauth2redirect` call, tying the attack flow together.\n\n## 2. PoC\n\nA conceptual attack (no Docker needed):\n\n```\nScenario: OAuth2 provider has loose redirect URI validation\n          (e.g., allows wildcard subdomain matching)\n\n1. Attacker crafts a URL to the dashboard's OAuth2 login endpoint\n   with a modified Host header:\n\n   GET /api/v1/oauth2/github HTTP/1.1\n   Host: attacker-controlled.com\n   X-Forwarded-Proto: https\n\n2. The dashboard responds with a redirect to:\n   https://github.com/login/oauth/authorize?client_id=...&redirect_uri=https://attacker-controlled.com/api/v1/oauth2/callback&state=...\n\n3. Victim clicks the attacker's link → authenticates with GitHub\n   → GitHub redirects to https://attacker-controlled.com/api/v1/oauth2/callback?code=AUTH_CODE&state=...\n\n4. Attacker captures the AUTH_CODE from their server logs\n\n5. Attacker exchanges the code at the real dashboard's\n   /api/v1/oauth2/callback endpoint (using the real Host header\n   this time), binding the victim's OAuth identity to their\n   dashboard account\n```\n\n**Prerequisites for full exploit:**\n- The victim must click the attacker's crafted link\n- The OAuth2 provider must accept the attacker's domain as a valid redirect URI (some providers accept `https://*/*` or allow wildcards; others are strict)\n\n## 3. Impact\n\n- **Account takeover**: an attacker who intercepts the OAuth2 authorization code can bind the victim's OAuth identity (GitHub, Google, GitLab, etc.) to their own dashboard account, gaining the victim's access level and permissions\n- **Privilege escalation**: if the victim is an admin, the attacker gains full administrative control over the Nezha deployment — access to all servers, credentials, and configuration\n- **Persistence**: once bound, the attacker retains access even if the victim resets their password (unless they also unbind the OAuth2 identity)\n\nThe attack complexity is higher than typical Host header injection scenarios because it requires:\n1. The `Host` header to reach the dashboard's handler unmodified (bypassing reverse proxy normalization)\n2. The OAuth2 provider to have loose redirect URL validation\n3. User interaction (the victim must authenticate)\n\nHowever, the code-level vulnerability is unambiguous: the application trusts attacker-controlled input (`Host` header) for a security-critical URL that participates in the OAuth2 authorization code flow.\n\n## 4. Remediation\n\n1. **Validate the Host header** against a configured allowlist of known dashboard hostnames:\n   ```go\n   func getRedirectURL(c *gin.Context) string {\n       host := c.Request.Host\n       if !singleton.Conf.IsAllowedHost(host) {\n           host = singleton.Conf.DashboardBaseURL // fallback\n       }\n       // ...\n   }\n   ```\n\n2. **Pin the redirect URL** to the configured dashboard URL from `singleton.Conf` instead of deriving it from the request Host header:\n   ```go\n   func getRedirectURL(c *gin.Context) string {\n       return singleton.Conf.DashboardBaseURL + \"/api/v1/oauth2/callback\"\n   }\n   ```\n\n3. **Remove Host header-based URL construction** entirely — the OAuth2 redirect URL should be deterministic based on server configuration, not dynamic per-request\n\n4. **Add Host header validation middleware** for all OAuth2-related endpoints as defense-in-depth","state":0,"publishedAt":"2026-06-26T23:05:19+00:00","modifiedAt":"2026-07-07T16:11:15.9131725+00:00","affected":[{"ecosystem":"Go","name":"github.com/nezhahq/nezha","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"2.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx","https://nvd.nist.gov/vuln/detail/CVE-2026-53523","https://github.com/nezhahq/nezha"],"sourceUrl":"https://github.com/advisories/GHSA-9rc6-8cjv-rcvx","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9rc6-8cjv-rcvx","identifiers":["GHSA-9rc6-8cjv-rcvx","CVE-2026-53523","GO-2026-5829"]},"retained":false,"historicalAffected":[]},{"revision":"bc86a7e3f51849c7949a50dc82d5676a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5829","aliases":["CVE-2026-53523","GHSA-9rc6-8cjv-rcvx"],"title":"Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection in github.com/nezhahq/nezha","description":"Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection in github.com/nezhahq/nezha.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/nezhahq/nezha before v2.2.0.","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:00:21.9652923+00:00","affected":[{"ecosystem":"Go","name":"github.com/nezhahq/nezha","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx","https://nvd.nist.gov/vuln/detail/CVE-2026-53523"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5829","license":"OSV · upstream source license applies","key":"osv:GO-2026-5829","identifiers":["GO-2026-5829","CVE-2026-53523","GHSA-9rc6-8cjv-rcvx"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.014368+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.014369+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-aac6631b84e101279eb6b1c3835f52bf7b26c50f4d25bc0fb35977235593f4a7","complete":true,"records":420943,"lastAttemptAt":"2026-11-07T20:07:23.1739993+00:00","lastSuccessAt":"2026-11-07T20:07:23.0712879+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.1739993+00:00","snapshotPublishedAt":"2026-11-07T19:18:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c5a2504558b549559b8658a653596391","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T20:19:26.3099435+00:00","lastSuccessAt":"2026-11-07T20:19:26.304+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:19:26.304+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:07:23.8593986+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:07:23.8593986+00:00","lastSuccessAt":"2026-11-07T20:07:24.0152025+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:24.0152028+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-191690d52ba04a91b1a2749fa6191ceb","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:07:42.8841875+00:00","lastSuccessAt":"2026-11-07T20:07:42.881+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:42.881+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:07:23.800032+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.800032+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:07:23.2420378+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.2420378+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:07:23.8227715+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.8227715+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:07:23.4659623+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:07:23.4659623+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}