CVE-2026-53523

## 1. Description The `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenating the request's `Host` header with a fixed path, with **zero validation** of the Host header: ```go func getRedirectURL(c *gin.Context) string { scheme := "http://" referer := c.Request.Referer() if forwardedProto := c.Request.Header.Get("X-Forwarded-Proto"); forwardedProto == "https" || strings.HasPrefix(referer, "https://") { scheme = "https://" } return scheme + c.Request.Host + "/api/v1/oauth2/callback" } ``` **File:** `cmd/dashboard/controller/oauth2.go:22-29` This function is called from `oauth2redirect()` at line 53: ```go func oauth2redirect(c *gin.Context) (*model.Oauth2LoginResponse, error) { // ... redirectURL := getRedirectURL(c) o2conf := o2confRaw.Setup(redirectURL) // ... url := o2conf.AuthCodeURL(state, oauth2.AccessTypeOnline) return &model.Oauth2LoginResponse{Redirect: url}, nil } ``` The `redirectURL` is passed into `o2confRaw.Setup(redirectURL)` which configures the OAuth2 `Config.RedirectURL` field (`oauth2config.go:22-33`). This `RedirectURL` is sent to the OAuth2 provider (e.g., GitHub, Google, Microsoft) as the callback endpoint. The OAuth2 provider will redirect the user's browser — along with the authorization code — to this URL after the user authenticates. The security issue is that `c.Request.Host` is directly user-controllable via the HTTP `Host` header. An attacker who can control which Host header reaches the oauth2redirect handler can: 1. Set `Host: evil.com` 2. `getRedirectURL` returns `https://evil.com/api/v1/oauth2/callback` 3. The OAuth2 provider redirects the victim's auth code to `evil.com` 4. The attacker's server at `evil.com` captures the auth code 5. The attacker exchanges the code for an access token, binding the victim's OAuth identity to the attacker's dashboard account The scheme detection (lines 24-27) uses `X-Forwarded-Proto` and the `Referer