Executive Summary

This vulnerability exists in Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. It is a server-side open redirect issue in the navigateTo function, which fails to properly validate certain path-normalized payloads such as /..//evil.com and /.//evil.com.

Attackers can exploit this flaw by bypassing external-host checks using path-normalization techniques, allowing them to redirect users to attacker-controlled websites via the Location header or meta-refresh.

This can be used to facilitate phishing attacks and theft of OAuth authorization codes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by enabling attackers to redirect your users to malicious websites without proper validation.

This can lead to phishing attacks where users are tricked into providing sensitive information.

Additionally, attackers can steal OAuth authorization codes, potentially compromising user accounts and access.

Useful 0 Not Useful 0