Executive brief
Nuxt UI's form components (UForm and UAuthForm) render HTML forms without specifying a submission method, causing credentials to be sent as URL query parameters if users submit the form before the application fully loads. Passwords and email addresses can leak into browser history, HTTP referrer headers, CDN logs, and network monitoring tools, potentially exposing user credentials to anyone with access to these systems.
Technical details
The vulnerability is a timing-based information disclosure (CWE-200, CWE-598) in server-side rendering of UForm and UAuthForm components in @nuxt/ui. The rendered form element has no method attribute and relies on Vue's @submit.prevent handler (which only attaches after client-side hydration) to intercept submission. If a user submits the form before hydration completes—due to slow network, CSP-blocked JavaScript, or CDN failure—the browser defaults to GET submission, serializing all named form fields (including password inputs) into the query string. The password then appears in the URL, browser history, referrer headers, access logs, and WAF/CDN records. The fix, available in version 4.8.1, explicitly sets method="post" on the form element so pre-hydration submissions use POST instead of GET.
Affected products
- Nuxt UI <4.8.1
Timeline
- 2026-07-02: disclosed
- 2026-07-02: patched: Fixed in v4.8.1 via PR #6512