Executive brief
Nezha Monitoring, a server management and monitoring dashboard, contains a vulnerability that allows a user to hijack another user's Dynamic DNS (DDNS) settings. By predicting and saving a future identification number for a setting that hasn't been created yet, an attacker can force the system to use a victim's credentials and configuration for the attacker's own server once the victim eventually creates that setting. This could lead to unauthorized DNS record updates and the misuse of third-party DNS provider credentials.
Technical details
A second-order authorization bypass exists in Nezha Monitoring's server update path. The `PATCH /server/{id}` endpoint validates existing DDNS profile IDs but fails to reject nonexistent IDs, persisting them in `DDNSProfilesRaw`. When a victim later creates a DDNS profile that matches a pre-bound ID (due to predictable auto-incrementing keys), the background DDNS worker resolves the profile and dispatches updates using the victim's provider configuration (including access secrets and domains) for the attacker's server context. This occurs because the worker path lacks re-validation of profile ownership at the time of dispatch. The vulnerability is addressed in version 2.1.0.
Affected products
- nezhahq Nezha Monitoring >= 2.0.14, < 2.1.0
Timeline
- 2026-05-31: disclosed
- 2026-06-26: advisory
- 2026-06-26: patched