Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches Nezha with a forged Host header can cause an attacker-controlled callback URL to be used as the redirect_uri; if the OAuth2 provider accepts it, the victim's authorization code is delivered to the attacker origin, allowing the attacker to complete the OAuth2 login/binding flow and take over the account. This regresses the fix for GHSA-9rc6-8cjv-rcvx and is configuration-dependent (dashboard_host empty). At the time of the advisory no patched version was available.

Source published

27 Sep 2026 20:50:00 UTC

Source modified

28 Sep 2026 13:00:01 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1 · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches Nezha with a forged Host header can cause an attacker-controlled callback URL to be used as the redirect_uri; if the OAuth2 provider accepts it, the victim's authorization code is delivered to the attacker origin, allowing the attacker to complete the OAuth2 login/binding flow and take over the account. This regresses the fix for GHSA-9rc6-8cjv-rcvx and is configuration-dependent (dashboard_host empty). At the time of the advisory no patched version was available.

Source published

Sep 27, 2026, 8:50:00 PM (timezone not stated)

Source modified

Sep 28, 2026, 1:00:01 PM (timezone not stated)

Observed here

11 Nov 2026 05:28:03 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty, /api/v1/oauth2/{provider} (cmd/dashboard/controller/oauth2.go) reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider instead of falling back to the configured install_host. An attacker who induces a victim to begin OAuth2 login via a request that reaches Nezha with a forged Host header can cause an attacker-controlled callback URL to be used as the redirect_uri; if the OAuth2 provider accepts it, the victim's authorization code is delivered to the attacker origin, allowing the attacker to complete the OAuth2 login/binding flow and take over the account. This regresses the fix for GHSA-9rc6-8cjv-rcvx and is configuration-dependent (dashboard_host empty). At the time of the advisory no patched version was available.

Source published

27 Sep 2026 21:17:03 UTC

Source modified

28 Sep 2026 21:02:16 UTC

Observed here

25 Oct 2026 04:17:26 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Summary Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new `dashboard_host` setting is empty. In that configuration, `/api/v1/oauth2/{provider}` again reflects the request `Host` header into the OAuth2 `redirect_uri` sent to the identity provider, even if `install_host` is configured. ## Impact An attacker who can get a victim to start OAuth2 login through a request that reaches Nezha with a forged `Host` header can make Nezha send an attacker-controlled callback URL as the OAuth2 `redirect_uri`. If the configured OAuth2 provider accepts that redirect URI, the victim's authorization code is sent to the attacker origin. The attacker can then complete the OAuth2 binding or login flow described in GHSA-9rc6. This is configuration-dependent, but it affects a realistic upgrade/default state because `dashboard_host` is a new optional field. The original v2.2.0 fix fell back to `install_host`; current v2.2.3 only falls back when `dashboard_host` is non-empty. ## Reproduction On current v2.2.3 / master commit `3d74cd9431a48fa89c6489689eac82a872799ea0`, configure OAuth2 and set an existing dashboard host only through `install_host`, leaving `dashboard_host` empty. Then send the OAuth2 redirect request with a forged Host header: ```http GET /api/v1/oauth2/github?type=1 HTTP/1.1 Host: evil.attacker.test X-Forwarded-Proto: https ``` The generated OAuth2 authorization URL contains: ```text redirect_uri=https%3A%2F%2Fevil.attacker.test%2Fapi%2Fv1%2Foauth2%2Fcallback ``` A minimal route-level unit test demonstrating the issue is: ```go func TestOAuth2Redirect_RegressionWhenDashboardHostEmptyReflectsForgedHost(t *testing.T) { defer setupOAuth2Test(t)() singleton.Conf.InstallHost = "legit-dashboard.example.com" singleton.Conf.DashboardHost = "" singleton.Conf.Oauth2["github"] = &model.Oauth2Config{ ClientID: "client-id", ClientSecret: "client-secret", Endpoint: model.Oauth2Endpoint{AuthURL: "https://idp.example.test/authorize", TokenURL: "https://idp.example.test/token"}, Scopes: []string{"openid"}, } c, _ := newOAuth2Ctx(t) c.Params = gin.Params{{Key: "provider", Value: "github"}} c.Request.Host = "evil.attacker.test" c.Request.URL.RawQuery = "type=1" c.Request.Header.Set("X-Forwarded-Proto", "https") resp, err := oauth2redirect(c) require.NoError(t, err) parsed, err := url.Parse(resp.Redirect) require.NoError(t, err) require.Equal(t, "https://evil.attacker.test/api/v1/oauth2/callback", parsed.Query().Get("redirect_uri")) } ``` The corresponding control with `DashboardHost = "panel.example.com"` pins the same forged request to `https://panel.example.com/api/v1/oauth2/callback`, so the issue is specifically the empty `dashboard_host` fallback. ## Root cause Current `cmd/dashboard/controller/oauth2.go` chooses the request Host unless `DashboardHost` is non-empty: ```go host := c.Request.Host if !singleton.IsReservedDashboardHost(host) && singleton.Conf != nil && singleton.Conf.DashboardHost != "" { host = singleton.Conf.DashboardHost } return scheme + host + "/api/v1/oauth2/callback" ``` The v2.2.0 fix used `InstallHost` as the fallback for untrusted request hosts. After `DashboardHost` was introduced, empty `dashboard_host` now disables host pinning and reintroduces the original Host header injection behavior for those deployments. ## Remediation Build the OAuth2 callback URL from a deterministic configured origin. For example: 1. Use `DashboardHost` when it is set. 2. Otherwise fall back to `InstallHost` if it is set, preserving the v2.2.0 invariant for existing deployments. 3. If neither value is set, reject OAuth2 redirect initiation with a configuration error instead of reflecting request Host. Please also add a regression test that `InstallHost` plus empty `DashboardHost` does not reflect a forged Host into `redirect_uri`.

Source published

15 Sep 2026 19:50:08 UTC

Source modified

28 Sep 2026 17:11:14 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Publisher rating · LOW

Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty in github.com/nezhahq/nezha

Source published

28 Sep 2026 16:43:40 UTC

Source modified

28 Sep 2026 17:11:14 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.