Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-14 | 1 | General1 |
| 2026-06-27 | 1 | Disclosure1 |
🟠 Nezha Monitoring, OAuth2 Host Header Injection, #CVE-2026-53523 (MEDIUM) -DC-Jun2026-725 https://dailycve.com/nezha-monitoring-oauth2-host-header-injection-cve-2026-53523-medium-dc-jun2026-725/
Post summary
The text announces a new OAuth2 Host Header Injection vulnerability in Nezha Monitoring, CVE-2026-53523, rated MEDIUM, but lacks exploitation, fix, or PoC details.
CVE-2026-53523 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL functio… https://www.cve.org/CVERecord?id=CVE-2026-53523
Post summary
The text cites CVE-2026-53523 for Nezha Monitoring but gives no substantive details on the nature, exploitation, or remediation of the vulnerability.