CVE-2026-111387 | nezhahq Nezha up to 2.3.14 DDNS /api/v1/ddns listDDNS WebhookURL/WebhookRequestBody missing encryption

October 16, 2026 Yanac

A vulnerability has been found in nezhahq Nezha up to 2.3.14 and classified as problematic. Affected by this vulnerability is the function listDDNS of the file /api/v1/ddns of the component DDNS. The manipulation of the argument WebhookURL/WebhookRequestBody leads to missing encryption of sensitive data.

This vulnerability is referenced as CVE-2026-111387. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More