The vulnerability exists in Nezha from version 2.2.5 up to but not including 2.3.15. An authenticated user with the nezha:ddns:read scope can use the GET /api/v1/ddns endpoint to retrieve cleartext tokens embedded in DDNS webhook profiles. This exposure allows attackers to obtain third‑party credentials and potentially compromise services that rely on those tokens. The weakness is an information exposure flaw (CWE‑212).

Nezha, as distributed by nezhahq, is affected. The vulnerability applies to all releases starting with 2.2.5 through 2.3.14 inclusive.

The CVSS base score of 7.1 indicates moderate severity. The EPSS score is 0.00264, indicating a very low exploitation probability of about 0.26%. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires legitimate authentication and the ddns:read privilege, so the risk is primarily internal. If an attacker obtains a user or PAT with the necessary scope, they can read sensitive credentials. The attack surface is limited to users who have been granted ddns:read access; no remote code execution or privilege escalation is involved.