Medium severity6.8NVD Advisory· Published Jun 12, 2026· Updated Jun 15, 2026
CVE-2026-53523
CVE-2026-53523
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
1- Nezha Monitoring: 13 CVEs Disclosed, Including Critical Command Injection and Path BypassVypr Intelligence · Jun 12, 2026