Medium, CVSS 6.9npmAmendedPublished
@nuxt/ui: UAuthForm / UForm SSR markup omits method, leaking credentials via GET if submitted before hydration
GHSA-gj2h-2fpw-fhv9
- Affected
- npm @nuxt/ui < 4.8.1
- Fixed in
- 4.8.1· Vendor fix available
- Issue
- UForm and UAuthForm render a server-side <form element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler (autofill plus Enter on a slow network, JS bundle blocked by CSP or CDN failure, etc.), the browser performs the native default: a GET to the current URL with every named field, including <input type="password", serialised into the query string. Details src/runtime/components/Form.vue (around the template's <form element) emits: No method, no action. @submit.prevent is the only thing stopping native submission, and it only exists after hydration. UAuthForm composes UForm and inherits the same shape. The SSR snapshot of UAuthForm (test/components/snapshots/AuthForm.spec.ts.snap) shows the rendered markup, with <input type="password" name="password" inside a <form that has no method. Proof of concept Reported by @nimonian: 1. Create a minimal…
Recommended action: Upgrade to 4.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.