Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 2.9, published 15 September 2026.

Which products and versions are affected?

github.com/nezhahq/nezha (Go) = 2.2.3.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run github.com/nezhahq/nezha (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Nezha OAuth2 redirect_uri Host header injection regression

Severity: low · CVSS 2.9 · Published 2026-09-15

Nezha v2.2.3 contains a regression in OAuth2 handling where forged HTTP Host headers are reflected into OAuth2 redirect URLs when the new `dashboard_host` configuration is left empty. An attacker can trick a victim into initiating OAuth2 login via a request with a malicious Host header, causing Nezha to send the victim's authorization code to an attacker-controlled server instead of the legitimate OAuth provider, potentially leading to account takeover if the OAuth provider accepts the forged redirect URL.

Technologies: github.com/nezhahq/nezha (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 2.9, published 15 September 2026.
Which products and versions are affected?: github.com/nezhahq/nezha (Go) = 2.2.3.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run github.com/nezhahq/nezha (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Host header injection vulnerability in the OAuth2 redirect URI construction logic in `cmd/dashboard/controller/oauth2.go`. The vulnerable code chooses the request Host header directly unless `DashboardHost` is explicitly configured as non-empty; when `DashboardHost` is empty (the default for v2.2.3), the request-supplied Host header is used to build the OAuth2 callback URL, even if `InstallHost` is configured. An attacker who can reach the Nezha instance with a forged Host header (via DNS spoofing, HTTP Host header manipulation, or misconfigured proxy) can make Nezha send an attacker-controlled redirect URI to the OAuth2 provider. If the provider accepts this URI, the victim's authorization code is exfiltrated to the attacker. This regresses a v2.2.0 fix that correctly fell back to `InstallHost`. The vulnerability requires the victim to initiate OAuth2 login and the OAuth provider to accept the forged redirect URI, but affects the realistic default/upgrade scenario where `dashboard_host` is a new optional field left unset.

Affected products

Nezha Nezha 2.2.3

Timeline

2026-09-15: disclosed: Advisory published to GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.