CVE-2026-101090 nezhahq CVE debrief

Who should care

Defenders responsible for Nezha installations, particularly those using the OAuth2 login feature, should assess their exposure and verify the dashboard_host setting. Additionally, security teams monitoring for suspicious OAuth2 login attempts should be aware of this vulnerability.

Why it matters

CVE-2026-101090 is a critical vulnerability in Nezha 2.2.3 that allows an attacker to control the redirect_uri in the OAuth2 login flow, potentially leading to account takeover. Defenders should prioritize verifying the dashboard_host setting and monitoring for suspicious OAuth2 login attempts.

• An attacker can control the redirect_uri and potentially take over the victim's account
• Defenders need to verify the dashboard_host setting to prevent this vulnerability
• Monitoring for suspicious OAuth2 login attempts is crucial to detect potential exploitation
• The vulnerability requires configuration-dependent exploitation (dashboard_host empty)

Technical summary

The vulnerability is a Host header injection regression in the OAuth2 redirect endpoint of Nezha 2.2.3. When the dashboard_host setting is empty, the /api/v1/oauth2/{provider} endpoint reflects the attacker-supplied HTTP Host header into the redirect_uri sent to the identity provider. This allows an attacker to control the callback URL and potentially take over the victim's account by completing the OAuth2 login/binding flow. Defenders should prioritize verifying the dashboard_host setting and ensuring it is not empty to prevent this vulnerability. Additionally, defenders should monitor for any suspicious OAuth2 login attempts and review the redirect_uri sent to the identity provider to detect potential attacks

Defensive priority

Defenders should prioritize verifying the dashboard_host setting and ensuring it is not empty to prevent this vulnerability. Additionally, defenders should monitor for any suspicious OAuth2 login attempts and review the redirect_uri sent to the identity provider.

Recommended defensive actions

• Verify the dashboard_host setting and ensure it is not empty
• Monitor for suspicious OAuth2 login attempts
• Review the redirect_uri sent to the identity provider
• Consider updating to a patched version when available
• Confirm whether affected Nezha 2.2.3 deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, CVSS score, and affected product. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.