CVE-2026-119201

The record

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.

Affected packages

Related vulnerabilities

• CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-552
• CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control… CWE-552
• CVE-2026-65210 This issue may allow an authenticated IPMI Administrator to read arbitrary files from the… CWE-552
• CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displayed in a… CWE-552
• CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allows… CWE-552
• CVE-2026-87348 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft… CWE-552
• CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allows an… CWE-552
• CVE-2026-21589 This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service… CWE-552