---
id: "CVE-2026-119201"
kind: "vulnerability"
aliases: ["CVE-2026-119201"]
title: "Nuxt: dev server exposes app secret, letting attackers forge session cookies"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dev-server", "node", "nuxt", "package", "vue"]
not_affected_if: ["default-config-localhost", "explicit-appsecret", "production-build", "static-export"]
published_at: "2026-10-29T21:17:19+00:00"
first_seen_at: "2026-10-29T21:26:51+00:00"
updated_at: "2026-10-29T21:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119201", "first_seen_at": "2026-10-29T21:26:51+00:00"}]
---

# Nuxt: dev server exposes app secret, letting attackers forge session cookies

From Nuxt 4.6.0 to 4.6.2, the nuxt dev server writes a generated appSecret file that sits inside a directory Vite serves. A client that can reach an exposed dev server can read that file, derive the default useSession password, and forge session cookies the dev server accepts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nuxt version with `npx nuxt --version` or the `nuxt` entry in `package.json` and `package-lock.json`.
- Look for a `.nuxt/app-secret` file in the project and confirm whether `appSecret` is set explicitly in the Nuxt config.
- Check whether `nuxt dev` is bound to a non-localhost address and reachable from other machines.

## Fix

- Nuxt: move to `4.6.3`

## Timeline

- 2026-10-29T21:26:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119201

## From the sources

Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, nuxt dev stores a generated appSecret in <buildDir>/app-secret, by default .nuxt/app-secret, within a directory allowed by Vite's server.fs configuration. A client with direct HTTP access to an exposed development server can fetch the file, use deriveSecret() to compute derived secrets such as the default useSession password, and forge session cookies accepted by that development server. The default localhost binding limits remote exposure, cross-origin browser reads are blocked, production builds and development servers with an explicitly configured appSecret are not affected. This issue is fixed in version 4.6.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_