Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-101090 · Microsoft / collected KEV context

EUVD-2026-88025

GHSA-62gj-x2f3-j2wj

GHSA-rf68-8gjr-36q7

GO-2026-6486

cve-program · CVE-2026-101090

• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://www.vulncheck.com/advisories/nezha-through-2.2.3-host-header-injection-via-oauth2-redirect-uri

euvd · EUVD-2026-88025

• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://www.vulncheck.com/advisories/nezha-through-2.2.3-host-header-injection-via-oauth2-redirect-uri

nvd · CVE-2026-101090

• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://www.vulncheck.com/advisories/nezha-through-2.2.3-host-header-injection-via-oauth2-redirect-uri

osv · GHSA-rf68-8gjr-36q7

• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://github.com/nezhahq/nezha/commit/38824dbc11a63964c5b9296ae4c68e62b34fa04b
• https://github.com/nezhahq/nezha

osv · GO-2026-6486

• https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7
• https://github.com/nezhahq/nezha/commit/38824dbc11a63964c5b9296ae4c68e62b34fa04b

No related operational record is retained in the current change model.