Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
PUBLISHED5.2CWE-522
Nezha before 2.2.7 Information Disclosure via /api/v1/profile
Problem type
Affected products
nezhahq
nezha
< 2.2.7 - AFFECTED
2.2.7 - UNAFFECTED
References
GitHub Security Advisory (GHSA-8jhq-g4gw-rv5f)
https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f
VulnCheck Advisory: Nezha before 2.2.7 Information Disclosure via /api/v1/profile
https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile
GitHub Security Advisories
GHSA-q59m-xcw2-hxpc
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile...
https://github.com/advisories/GHSA-q59m-xcw2-hxpcNezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.
github.com
https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f
nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-101089
vulncheck.com
https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile
github.com
https://github.com/advisories/GHSA-q59m-xcw2-hxpc
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-101089Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-101089",
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"dateUpdated": "2026-09-27T20:50:00.193Z",
"dateReserved": "2026-09-27T20:29:07.432Z",
"datePublished": "2026-09-27T20:50:00.193Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck",
"dateUpdated": "2026-09-27T20:50:00.193Z"
},
"datePublic": "2026-06-28T00:00:00.000Z",
"title": "Nezha before 2.2.7 Information Disclosure via /api/v1/profile",
"descriptions": [
{
"lang": "en",
"value": "Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints."
}
],
"affected": [
{
"vendor": "nezhahq",
"product": "nezha",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"status": "affected",
"versionType": "semver",
"lessThan": "2.2.7"
},
{
"version": "2.2.7",
"status": "unaffected",
"versionType": "semver"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Insufficiently Protected Credentials",
"cweId": "CWE-522",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f",
"name": "GitHub Security Advisory (GHSA-8jhq-g4gw-rv5f)",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile",
"name": "VulnCheck Advisory: Nezha before 2.2.7 Information Disclosure via /api/v1/profile",
"tags": [
"third-party-advisory"
]
}
],
"metrics": [
{
"format": "CVSS"
},
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW"
}
}
],
"credits": [
{
"lang": "en",
"value": "de3erve-hunter",
"type": "reporter"
}
]
}
}
}