{"uuid": "807ea201-2792-494d-ba80-151f35741c87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-101090", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117346076185376703", "content": "Nezha 2.2.3 (CVE-2026-101090): CRITICAL open redirect via Host header injection in OAuth2 flow. Account takeover possible if dashboard_host is unset. Set to trusted value; no patch yet. https://radar.offseq.com/threat/cve-2026-101090-url-redirection-to-untrusted-site-open-redirect-in-nezhahq-nezha-17f76beacc249b5e #OffSeq #OAuth2 #Vulnerability #InfoSec", "creation_timestamp": "2026-09-28T01:30:27.495385Z"}