CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Attackers can inject malicious Host headers to redirect users to external sites during OAuth2 authentication, potentially leading to credential theft.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-53523?
CVE-2026-53523 is a medium-severity vulnerability in nezhahq nezha, published on 12 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.
Weakness: CWE-601
Which versions are affected by CVE-2026-53523?
3 open source packages ship an affected version, including github.com/nezhahq/nezha.
| Package | Affected | Fixed in |
|---|---|---|
github.com/nezhahq/nezha Go | From 1.0.0 | None |
github.com/nezhahq/nezha Go | From 1.0.0 | 2.2.0 |
github.com/nezhahq/nezha Go | From 1.0.0 | 2.2.0 |
How do I fix CVE-2026-53523?
Upgrade github.com/nezhahq/nezha to 2.2.0 or later.
Is CVE-2026-53523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53523 exists.
Sources
Also known as GHSA-9rc6-8cjv-rcvx, GO-2026-5829.