Nezha Monitoring exposes third‑party credentials such as Cloudflare API tokens, TencentCloud SecretKeys, and service webhooks for Slack, Discord, and Telegram through its GET /api/v1/ddns and GET /api/v1/notification endpoints. The returned objects contain plaintext values, including authorization headers, because no field‑level redaction is applied. The flaw is a CWE‑200 Sensitive Data Exposure that compromises confidentiality by leaking credentials that could later be used to hijack external services or pivot to other systems.

The vulnerability affects installations of Nezha Monitoring that run any version before 2.2.5. An attacker who has authenticated access with either the nezha:ddns:read or nezha:notification:read scope—such as an administrator or a personal token—can retrieve the full list of DDNS or notification configurations in a single API call.

The CVSS score of 6.9 indicates moderate severity and the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. Because the flaw is triggered by normal, authenticated API calls, an attacker who gains the necessary permissions can obtain the credentials instantly. The vulnerability is not listed in the CISA KEV catalog, but the exposure of sensitive third‑party credentials can enable further attacks such as service hijacking or lateral movement.