Is CVE-2026-123808 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123808 being exploited in the wild.

How severe is CVE-2026-123808?

Medium severity, with a CVSS score of 5.3, published 9 November 2026.

Is there a fix for CVE-2026-123808?

Yes: fixed in 4.8.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123808 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123808?

Check whether you run Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123808: Nuxt UI form credential leaking via pre-hydration GET submission

CVE-2026-123808 · Severity: medium · CVSS 5.3 · Published 2026-11-09

Nuxt UI is a Vue component library used to build web application interfaces. The library's form component failed to specify an HTTP submission method, causing browsers to use GET by default if the page submits before JavaScript loads. This sends passwords and other credentials as visible URL parameters, exposing them in browser history, server logs, and security tools.

Vendors: Nuxt.

Quick answers

Is CVE-2026-123808 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123808 being exploited in the wild.
How severe is CVE-2026-123808?: Medium severity, with a CVSS score of 5.3, published 9 November 2026.
Which products and versions are affected?: Nuxt UI before 4.8.1.
Is there a fix for CVE-2026-123808?: Yes: fixed in 4.8.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123808 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123808?: Check whether you run Nuxt UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.8.1

Technical details

UForm renders a form element without method or action attributes, relying on Vue's @submit.prevent handler to prevent native submission. If form submission occurs before Vue hydration completes—due to slow networks, blocked JavaScript, or autofill triggering—the browser performs a default GET submission and serializes all fields including passwords into the URL query string. The fix adds method="post" to force POST as the pre-hydration fallback, preventing credential exposure in URLs, browser history, reverse proxies, CDNs, WAFs, and Referer headers.

Affected products

Nuxt UI before 4.8.1

Timeline

2026-11-09: disclosed
2026-05-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.