CVE-2026-62283

🗓️ 21 Aug 2026 20:21:28Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 71 Views🌐 WEB

Cross-tenant session hijack in Nezha Monitoring via WebSocket UUID without ownership check.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-62283	21 Aug 202622:07	–	circl
Cvelist	CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check	21 Aug 202620:21	–	cvelist
EUVD	EUVD-2026-64139	21 Aug 202620:21	–	euvd
Mend	CVE-2026-62283	21 Aug 202620:21	–	mend
NVD	CVE-2026-62283	21 Aug 202621:17	–	nvd
osv_ghsa	GHSA-Q6XX-5VR8-P898 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check	26 Jun 202622:31	–	osv_ghsa
osv_go	GO-2026-5821 Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check in github.com/nezhahq/nezha	7 Jul 202615:26	–	osv_go
Positive Technologies	PT-2026-79458	26 Jun 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-62283: Authorization Bypass Through User-Controlled Key	21 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check	21 Aug 202620:21	–	vulnrichment

Vulners

Node

nezhahq nezhaRange1.14.13–1.14.14

nezhahq nezhaRange2.0.0–2.0.10

[
  {
    "vendor": "nezhahq",
    "product": "nezha",
    "versions": [
      {
        "version": ">= 1.14.13, <= 1.14.14",
        "status": "affected"
      },
      {
        "version": ">= 2.0.0, < 2.0.10",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/nezhahq/nezha/releases/tag/v2.0.10
github	www.github.com/nezhahq/nezha/commit/6661d6a7fc1c269f55c7f4e775082ad23fbe0f54
github	www.github.com/nezhahq/nezha/security/advisories/GHSA-q6xx-5vr8-p898

Parameter	Position	Path	Description	CWE
:id	path	/ws/terminal/:id	An authenticated RoleMember can access and interact with another user's terminal session by providing a valid stream UUID, as the application fails to bind stream identifiers to specific users.	CWE-639, CWE-862
:id	path	/ws/file/:id	An authenticated RoleMember can access and interact with another user's file-manager session by providing a valid stream UUID, as the application fails to bind stream identifiers to specific users.	CWE-639, CWE-862

12 Oct 2026 16:10Current

6Medium risk

Vulners AI Score6

CVSS 3.19.9

EPSS0.00551

SSVC