CyberRota Analysis
AI-GeneratedThe vulnerability in Nezha versions prior to 2.2.7 allows unauthorized access to bcrypt-hashed passwords through the GET /api/v1/profile endpoint, potentially exposing sensitive user credentials. This information disclosure could enable attackers to perform offline cracking attacks without detection. Organizations using affected versions should prioritize patching to mitigate the risk of credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.