Nezha Monitoring versions 1.0.0 through 2.1.x have a flaw in the OAuth2 redirect URL generation where the Host header from the HTTP request is concatenated with a fixed path without any validation. This allows an attacker to supply a forged Host header, causing the constructed callback URL to point to an arbitrary domain. The resulting open redirect can be used to lure users to phishing sites, steal credentials, or perform social engineering attacks. The weakness is classified as CWE‑601.

Affected systems are deployments of Nezha Monitoring by nezhahq, specifically any installation from version 1.0.0 up to, but excluding, 2.2.0. The fix was released in version 2.2.0, which eliminates the unvalidated Host header usage.

The CVSS score of 6.8 indicates a moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue by sending a crafted HTTP request to the OAuth2 endpoint with a forged Host header; no authentication or privileged access is required. Because the flaw impacts the redirect flow, the primary risk exposure is user-facing phishing rather than direct code execution on the host.