CVE-2026-101090 affects Nezha version 2.2.3 and involves a Host header injection regression in the OAuth2 redirect endpoint (/api/v1/oauth2/{provider}). When the dashboard_host setting is empty, the application uses the HTTP Host header from the request to build the redirect_uri sent to the OAuth2 provider instead of the configured install_host. An attacker can exploit this by inducing a victim to initiate an OAuth2 login with a forged Host header, causing the victim's authorization code to be redirected to an attacker-controlled URL. This allows the attacker to complete the OAuth2 login or binding flow and take over the victim's account. This vulnerability reintroduces a previously fixed issue (GHSA-9rc6-8cjv-rcvx) and depends on the dashboard_host configuration. No official fix or patch was available at the time of publication.

Successful exploitation allows an attacker to hijack the OAuth2 login flow by redirecting the victim's authorization code to an attacker-controlled URL. This can lead to account takeover without requiring user interaction beyond initiating the login process. The vulnerability is critical due to its ability to bypass authentication controls and compromise user accounts.

At the time of the advisory, no patch or official fix was available. The vulnerability is configuration-dependent; setting the dashboard_host configuration to a non-empty, trusted value may mitigate the issue by preventing the use of the attacker-supplied Host header in the redirect_uri. Users should monitor the vendor's advisory for updates and apply any future patches promptly.