CVE-2026-119201

Name of the Vulnerable Software and Affected Versions Nuxt versions 4.6.0 through 4.6.2

Description In development mode, the framework stores a generated appSecret in the <buildDir>/app-secret file (defaulting to .nuxt/app-secret), which is located within a directory permitted by the Vite server.fs configuration. An attacker with direct HTTP access to an exposed development server can retrieve this file and use the deriveSecret() function to calculate derived secrets, such as the default useSession password. This allows the attacker to forge session cookies that the development server will accept.

Recommendations Update to version 4.6.3. Explicitly configure the appSecret for development servers to prevent the use of the generated secret.