Nezha 2.2.3 contains a Host header injection that leaks the attacker‑supplied Host header into the OAuth2 redirect_uri when the optional dashboard_host setting is left empty. The redirect_uri is sent to the identity provider without validation; if the provider accepts it, the victim’s authorization code is returned to the attacker’s origin. The attacker can then complete the OAuth authentication flow and bind the victim’s account to the attacker’s account, effectively taking over the victim’s account. This falls under CWE‑601: URL Redirection Through Untrusted Input.

The vulnerability is present only in Nezha version 2.2.3 when the dashboard_host configuration is empty. No patched version existed at the time of the advisory. The issue is limited to deployments of the specified Nezha product and version with that particular configuration.

The CVSS score of 9.3 indicates high severity, reflecting the remote nature of the attack and the potential for full account compromise. EPSS is not available, but the lack of a patch and the high CVSS suggest that exploit attempts are plausible. The vulnerability is not listed in CISA’s KEV catalog, but the attack vector is inferred to be remote, requiring an attacker to craft a request that forces a victim’s browser to hit Nezha with a forged Host header and to have the OAuth2 provider accept a malicious redirect_uri. If both conditions are met, exploitation is straightforward.