Executive Summary

This vulnerability affects Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7. The reloadNuxtApp function accepts protocol-relative paths such as //evil.com. These paths bypass the script-protocol check but resolve to a cross-origin URL based on the current page's protocol.

Attackers can exploit this by injecting such paths to redirect users to attacker-controlled hosts.

This enables phishing attacks and the theft of OAuth authorization codes.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to users being redirected to malicious websites controlled by attackers.

This can facilitate phishing attacks where users may be tricked into revealing sensitive information.

Additionally, attackers can steal OAuth authorization codes, potentially compromising user accounts and access.

Useful 0 Not Useful 0