CVE-2026-53523: Nezha Monitoring Host Header Injection

CVE-2026-53523 Overview

CVE-2026-53523 is a host header injection vulnerability in Nezha Monitoring, a self-hostable server and website monitoring tool. The flaw resides in the getRedirectURL function within oauth2.go (lines 22-29), which constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path. The function performs zero validation of the Host header, allowing attackers to manipulate the OAuth2 redirect destination. The issue affects versions 1.0.0 through versions prior to 2.2.0 and is classified under [CWE-601] (URL Redirection to Untrusted Site).

Critical Impact
An attacker can manipulate the OAuth2 callback URL to redirect authorization codes to an attacker-controlled host, enabling account takeover through OAuth2 flow hijacking.

Affected Products

Nezha Monitoring versions 1.0.0 through 2.1.x
Self-hosted Nezha deployments using OAuth2 authentication
Nezha instances exposed with user-controlled Host header routing

Discovery Timeline

2026-06-12 - CVE-2026-53523 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53523

Vulnerability Analysis

The vulnerability stems from improper trust in the HTTP Host header during OAuth2 callback URL construction. When a user initiates an OAuth2 authentication flow, Nezha's getRedirectURL function builds the redirect_uri parameter by reading the incoming request's Host header and appending a fixed callback path. Because the Host header is fully controllable by the client, an attacker can craft a request that causes the OAuth2 provider to redirect the authorization code or token to an attacker-controlled domain.

The attack succeeds when a victim is tricked into clicking a crafted login link or visiting a page that issues a request with a manipulated Host header. The OAuth2 provider receives the malicious redirect_uri, completes the authorization, and sends the authorization code back to the attacker's server. The attacker then exchanges the code for an access token and impersonates the victim.

Root Cause

The root cause is missing input validation on the Host header in the getRedirectURL function at oauth2.go:22-29. The function trusts client-supplied data when generating security-sensitive URLs. OAuth2 specifications require that redirect_uri values be strictly validated against an allowlist of registered callback URLs to prevent this class of attack.

Attack Vector

Exploitation requires network access to the vulnerable Nezha instance and user interaction in the form of clicking a malicious link. The attacker sends a crafted HTTP request with a spoofed Host header pointing to a domain they control. When the victim completes the OAuth2 authentication flow, the authorization code is delivered to the attacker's host instead of the legitimate Nezha instance.

No exploitation code is published for this CVE. See the GitHub Security Advisory GHSA-9rc6-8cjv-rcvx for additional technical detail.

Detection Methods for CVE-2026-53523

Indicators of Compromise

HTTP requests to Nezha endpoints containing Host header values that do not match the canonical deployment hostname
OAuth2 authorization callbacks referencing unfamiliar domains in redirect_uri parameters within proxy or web server logs
Anomalous outbound connections from Nezha to unexpected OAuth2 provider redirect targets

Detection Strategies

Inspect reverse proxy access logs for inbound requests where the Host header differs from the expected FQDN of the Nezha service
Correlate OAuth2 login flows with subsequent authentication events from atypical source IPs or user-agents
Audit OAuth2 application logs at the identity provider for redirect_uri values not on the approved allowlist

Monitoring Recommendations

Enable verbose logging on the front-facing web server or load balancer to capture all Host header values
Configure alerts on OAuth2 provider dashboards for callback URL mismatches and invalid redirect_uri errors
Track session creation events to identify accounts logging in from new or unusual locations following OAuth2 flows

How to Mitigate CVE-2026-53523

Immediate Actions Required

Upgrade Nezha Monitoring to version 2.2.0 or later, which patches the getRedirectURL function
Rotate any OAuth2 client secrets associated with affected Nezha deployments
Review user accounts for suspicious authentication events since the deployment of vulnerable versions

Patch Information

The vulnerability is fixed in Nezha Monitoring version 2.2.0. The patch introduces validation logic for the Host header used during OAuth2 callback URL construction. Refer to the GitHub Security Advisory GHSA-9rc6-8cjv-rcvx for commit-level details and upgrade instructions.

Workarounds

Place Nezha behind a reverse proxy configured to override the Host header with a fixed, trusted value before forwarding requests to the application
Configure the OAuth2 provider to enforce a strict allowlist of redirect_uri values matching only the canonical Nezha hostname
Restrict network access to the Nezha web interface to trusted IP ranges until the patch is applied

bash

# Example nginx configuration to enforce a fixed Host header upstream
server {
    listen 443 ssl;
    server_name nezha.example.com;

    location / {
        proxy_set_header Host nezha.example.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass http://127.0.0.1:8008;
    }
}