Executive brief
Nezha is a server monitoring dashboard application that manages authentication through OAuth2 providers. When the dashboard_host setting is left empty, the application reflects the HTTP Host header from incoming requests into the OAuth2 callback URL, allowing an attacker to redirect authorization codes to a malicious site. An attacker can use this flaw to hijack user login sessions by intercepting OAuth2 authorization codes during the login process.
Technical details
This is a Host header injection vulnerability in the OAuth2 redirect endpoint (cmd/dashboard/controller/oauth2.go). The application fails to validate the Host header when dashboard_host is empty, instead reflecting the untrusted request Host directly into the redirect_uri sent to the OAuth2 provider. An attacker can perform this attack remotely by sending requests with forged Host headers; the vulnerability requires the victim to initiate OAuth2 login, and the OAuth2 provider must accept the attacker-controlled redirect URI for exploitation. A regression from v2.2.0, this issue affects v2.2.3 deployments with empty dashboard_host and affects OAuth2 callback generation without proper fallback validation.
Affected products
- Nezha Nezha 2.2.3
Timeline
- 2026-09-15: disclosed