CVE-2026-53523 Details

A host header injection vulnerability has been identified in Nezha Monitoring versions 1.0.0 prior to 2.2.0. The issue arises in the 'getRedirectURL' function, where the OAuth2 callback URL is constructed by directly concatenating the request's Host header with a fixed path, without any validation of the Host header. This flaw allows an attacker to manipulate the Host header and intercept OAuth2 authorization codes, potentially leading to account takeover and privilege escalation, especially if the victim is an admin.

Users are advised to update to Nezha Monitoring version 2.2.0 or later. For those unable to update, validate the Host header against a configured allowlist of known dashboard hostnames, pin the redirect URL to the configured dashboard URL, remove Host header-based URL construction entirely, and add Host header validation middleware for all OAuth2-related endpoints.