Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-123808— Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Quick assessment

Affected
nuxt ui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Nuxt UI 是一个由 Reka UI 和 Tailwind CSS 驱动的直观 Vue UI 库。在 4.8.1 版本之前， 中的 组件在服务器端渲染时生成的表单元素会遗漏 和 属性，仅依赖客户端水合（hydration）后的 处理器来阻止原生表单提交。 组件由 组合而成，可在同一标记中渲染命名凭证字段，包括类型为 的输入框。 如果用户在 Vue 水合完成之前提交表单，或者当客户端资源包被阻止或不可用时，浏览器将执行默认的 GET 提交行为，并将命名字段序列化到当前 URL 的查询字符串中。这可能导致凭证信息出

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-123808

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
Source: CVE Program / CVE List V5
Vulnerability Description
Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native submission. UAuthForm composes UForm and can render named credential fields, including an input with type password, inside the same markup. If a user submits before Vue hydration completes, or when the client bundle is blocked or unavailable, the browser performs its default GET submission and serializes the named fields into the current URL query string. The credentials can then appear in the address bar, browser history, reverse-proxy, CDN, or WAF request logs, and Referer headers sent with same-origin subresource requests. This issue is fixed in version 4.8.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nuxt ui < 4.8.1 -

II. Public POCs for CVE-2026-123808

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-123808

请登录查看更多情报信息。

Other References for CVE-2026-123808 (4)

IV. Related Vulnerabilities

Same product: ui
Same vendor: nuxt
Same weakness: CWE-200