PT-2026-99160 · Go · Github.Com/Nezhahq/Nezha

Published

2026-09-15

·

Updated

2026-09-15

CVSS v4.0

2.9

Low

VectorAV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Summary

Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboard host setting is empty. In that configuration, /api/v1/oauth2/{provider} again reflects the request Host header into the OAuth2 redirect uri sent to the identity provider, even if install host is configured.

Impact

An attacker who can get a victim to start OAuth2 login through a request that reaches Nezha with a forged Host header can make Nezha send an attacker-controlled callback URL as the OAuth2 redirect uri. If the configured OAuth2 provider accepts that redirect URI, the victim's authorization code is sent to the attacker origin. The attacker can then complete the OAuth2 binding or login flow described in GHSA-9rc6.
This is configuration-dependent, but it affects a realistic upgrade/default state because dashboard host is a new optional field. The original v2.2.0 fix fell back to install host; current v2.2.3 only falls back when dashboard host is non-empty.

Reproduction

On current v2.2.3 / master commit 3d74cd9431a48fa89c6489689eac82a872799ea0, configure OAuth2 and set an existing dashboard host only through install host, leaving dashboard host empty. Then send the OAuth2 redirect request with a forged Host header:
http
GET /api/v1/oauth2/github?type=1 HTTP/1.1
Host: evil.attacker.test
X-Forwarded-Proto: https
The generated OAuth2 authorization URL contains:
text
redirect uri=https%3A%2F%2Fevil.attacker.test%2Fapi%2Fv1%2Foauth2%2Fcallback
A minimal route-level unit test demonstrating the issue is:
go
func TestOAuth2Redirect RegressionWhenDashboardHostEmptyReflectsForgedHost(t *testing.T) {
  defer setupOAuth2Test(t)()
  singleton.Conf.InstallHost = "legit-dashboard.example.com"
  singleton.Conf.DashboardHost = ""
  singleton.Conf.Oauth2["github"] = &model.Oauth2Config{
    ClientID: "client-id",
    ClientSecret: "client-secret",
    Endpoint: model.Oauth2Endpoint{AuthURL: "https://idp.example.test/authorize", TokenURL: "https://idp.example.test/token"},
    Scopes: []string{"openid"},
  }

  c,  := newOAuth2Ctx(t)
  c.Params = gin.Params{{Key: "provider", Value: "github"}}
  c.Request.Host = "evil.attacker.test"
  c.Request.URL.RawQuery = "type=1"
  c.Request.Header.Set("X-Forwarded-Proto", "https")

  resp, err := oauth2redirect(c)
  require.NoError(t, err)

  parsed, err := url.Parse(resp.Redirect)
  require.NoError(t, err)
  require.Equal(t, "https://evil.attacker.test/api/v1/oauth2/callback", parsed.Query().Get("redirect uri"))
}
The corresponding control with DashboardHost = "panel.example.com" pins the same forged request to https://panel.example.com/api/v1/oauth2/callback, so the issue is specifically the empty dashboard host fallback.

Root cause

Current cmd/dashboard/controller/oauth2.go chooses the request Host unless DashboardHost is non-empty:
go
host := c.Request.Host
if !singleton.IsReservedDashboardHost(host) && singleton.Conf != nil && singleton.Conf.DashboardHost != "" {
  host = singleton.Conf.DashboardHost
}
return scheme + host + "/api/v1/oauth2/callback"
The v2.2.0 fix used InstallHost as the fallback for untrusted request hosts. After DashboardHost was introduced, empty dashboard host now disables host pinning and reintroduces the original Host header injection behavior for those deployments.

Remediation

Build the OAuth2 callback URL from a deterministic configured origin. For example:
  1. Use DashboardHost when it is set.
  2. Otherwise fall back to InstallHost if it is set, preserving the v2.2.0 invariant for existing deployments.
  3. If neither value is set, reject OAuth2 redirect initiation with a configuration error instead of reflecting request Host.
Please also add a regression test that InstallHost plus empty DashboardHost does not reflect a forged Host into redirect uri.

Fix

Open Redirect

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-601

Related Identifiers

GHSA-RF68-8GJR-36Q7

Affected Products

Github.Com/Nezhahq/Nezha