CVE-2026-53523 MEDIUM

CVE-2026-53523: Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Vendor Nezhahq

Product nezha

Weakness CWE-601 · Open redirect

Published June 12, 2026

Last update June 15, 2026

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.

Key dates

02Disclosure timeline

June 12, 2026 CVE published

June 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-53523 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/601.html

Related vulnerabilities

04Related CVE

CVE-2026-28681 IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links CVE-2026-23730 WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle) CVE-2023-31229 WordPress WP Directory Kit Plugin <= 1.1.9 is vulnerable to Open Redirection CVE-2025-61782 Open Redirect in OpenCTI's SAML Authentication Flow CVE-2021-41180 Geolocation preview links can be set to arbitrary links in nextcloud talk