{"id":"CVE-2026-119201","kind":"vulnerability","aliases":["CVE-2026-119201"],"related":[],"title":"Nuxt: dev server exposes app secret, letting attackers forge session cookies","description":"Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.","summary":"From Nuxt 4.6.0 to 4.6.2, the nuxt dev server writes a generated appSecret file that sits inside a directory Vite serves. A client that can reach an exposed dev server can read that file, derive the default useSession password, and forge session cookies the dev server accepts.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dev-server","node","nuxt","package","vue"],"not_affected_if":["default-config-localhost","explicit-appsecret","production-build","static-export"],"how_to_check":"- Check the installed Nuxt version with `npx nuxt --version` or the `nuxt` entry in `package.json` and `package-lock.json`.\n- Look for a `.nuxt/app-secret` file in the project and confirm whether `appSecret` is set explicitly in the Nuxt config.\n- Check whether `nuxt dev` is bound to a non-localhost address and reachable from other machines.","fix":"- Nuxt: move to `4.6.3`","status":"open","published_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","triaged_at":"2026-10-29T21:28:55+00:00","updated_at":"2026-10-29T21:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T21:28:55Z","model":"claude-haiku-5-5","output":{"fix":"- Nuxt: move to `4.6.3`","reach":"network","title":"Nuxt: dev server exposes app secret, letting attackers forge session cookies","impact":"medium","summary":"From Nuxt 4.6.0 to 4.6.2, the nuxt dev server writes a generated appSecret file that sits inside a directory Vite serves. A client that can reach an exposed dev server can read that file, derive the default useSession password, and forge session cookies the dev server accepts.","audience":"developers","category":"package","nicknames":[],"who_cares":["nuxt","vue","node","dev-server"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker forges session cookies on the dev server","analyst_note":"","how_to_check":"- Check the installed Nuxt version with `npx nuxt --version` or the `nuxt` entry in `package.json` and `package-lock.json`.\n- Look for a `.nuxt/app-secret` file in the project and confirm whether `appSecret` is set explicitly in the Nuxt config.\n- Check whether `nuxt dev` is bound to a non-localhost address and reachable from other machines.","plain_action":"","needs_analyst":false,"not_affected_if":["production-build","default-config-localhost","explicit-appsecret","static-export"],"who_is_affected":"Only projects running `nuxt dev` from Nuxt 4.6.0 through 4.6.2 are at risk, and only when the dev server is reachable over the network and no appSecret is configured explicitly. Production builds are not affected, and the default localhost binding limits remote exposure. Teams using Nuxt only for production builds can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4239,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119201':14A,17A '-2026':13A,16A '/app-secret':94C '4.6.0':27B,84C '4.6.2':29B '4.6.3':86C,176C 'accept':71B,138C 'access':112C 'affect':169C 'allow':101C 'app':5A 'appsecret':37B,92C,166C 'attack':8A 'bind':146C 'block':156C 'browser':153C 'build':158C 'client':47B,108C 'comput':125C 'configur':106C,165C 'cooki':11A,67B,137C 'cross':151C 'cross-origin':150C 'cve':12A,15A 'default':61B,96C,131C,144C 'deriv':59B,126C 'derivesecret':123C 'dev':2A,19B,32B,53B,69B,88C 'dev-serv':18B 'develop':79C,116C,141C,160C 'direct':110C 'directori':43B,100C 'explicit':164C 'expos':4A,52B,115C 'exposur':149C 'fetch':119C 'file':38B,58B,121C 'fix':173C 'forg':9A,65B,135C 'framework':80C 'generat':36B,91C 'http':111C 'insid':41B 'issu':171C 'let':7A 'limit':147C 'localhost':145C 'node':21B 'nuxt':1A,22B,26B,31B,72C,87C 'nuxt/app-secret':97C 'open':76C 'open-sourc':75C 'origin':152C 'packag':23B 'password':63B,133C 'product':157C 'reach':50B 'read':56B,154C 'remot':148C 'secret':6A,127C 'serv':45B 'server':3A,20B,33B,54B,70B,117C,142C,161C 'server.fs':105C 'session':10A,66B,136C 'sit':40B 'sourc':77C 'store':89C 'use':122C 'usesess':62B,132C 'version':175C 'vite':44B,103C 'vue':24B 'vue.js':82C 'web':78C 'within':98C 'write':34B","nicknames":[],"mitigations":[],"who_affected":"Only projects running `nuxt dev` from Nuxt 4.6.0 through 4.6.2 are at risk, and only when the dev server is reachable over the network and no appSecret is configured explicitly. Production builds are not affected, and the default localhost binding limits remote exposure. Teams using Nuxt only for production builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119201","severity":null,"published_at":"2026-10-29T21:17:19+00:00","modified_at":"2026-10-29T21:17:19+00:00","first_seen_at":"2026-10-29T21:26:51+00:00","fetched_at":"2026-10-29T21:26:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}