Is there a patch available for CVE-2026-56326?

Yes, a patch is available for CVE-2026-56326. Update the affected software to the latest version immediately.

Nuxt CVE-2026-56326

Q: What is the CVSS score of CVE-2026-56326?

CVE-2026-56326 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of Nuxt are affected by CVE-2026-56326?

Server-side open redirect in Nuxt's `navigateTo` composable allows unauthenticated network attackers to bypass external-host checks by submitting path-normalized payloads such as `/..//evil.com` or…. A patch is available.

EUVD-2026-38375 MEDIUM

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-06-22 VulnCheck

Open Redirect Nuxt

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-accessible with no privileges required; user must click a crafted link; scope changes as redirect impacts a cross-origin system receiving stolen credentials.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 22:23 vuln.today

Analysis Generated

Jun 22, 2026 - 22:23 vuln.today

DescriptionCVE.org

Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.

AnalysisAI

Server-side open redirect in Nuxt's navigateTo composable allows unauthenticated network attackers to bypass external-host checks by submitting path-normalized payloads such as /..//evil.com or /.//evil.com, which WHATWG URL parsing resolves to the protocol-relative URL //evil.com. Affected versions are Nuxt 4.0.0-4.4.6 and all 3.x releases before 3.21.7. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Craft link with path-normalized redirect parameter

Delivery

Deliver link to victim via phishing

Exploit

Victim authenticates to Nuxt app

Install

SSR navigateTo normalizes path to //evil.com

Server issues Location: //evil.com header

Execute

Victim browser follows cross-origin redirect

Impact

Attacker captures session or OAuth authorization code

Recon

Craft link with path-normalized redirect parameter

Delivery

Deliver link to victim via phishing

Exploit

Victim authenticates to Nuxt app

Install

SSR navigateTo normalizes path to //evil.com

Server issues Location: //evil.com header

Execute

Victim browser follows cross-origin redirect

Impact

Attacker captures session or OAuth authorization code

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target Nuxt application to forward user-controlled input - such as a query parameter like `?next=`, `?redirect=`, or `?return_to=` - directly into the `navigateTo` function during server-side rendering without independent path sanitization. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 4.0 score of 5.3 with vector AV:N/AC:L/AT:N/PR:N/UI:P reflects a medium-severity, network-exploitable issue requiring passive user interaction (a victim must follow a crafted link), with limited confidentiality and integrity impacts (VC:L/VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a phishing email or message containing a login URL for a Nuxt application with a redirect parameter such as `?next=/..//evil.com`. When a victim clicks the link and completes authentication, the server-side `navigateTo` function processes the unvalidated parameter; WHATWG URL parsing normalizes `/..//evil.com` to `//evil.com`, and the server issues an HTTP response with `Location: //evil.com` or a `<meta http-equiv='refresh' content='0; url=//evil.com'>` tag. …
Remediation	Upgrade the `nuxt` npm package to version 4.4.7 (for 4.x projects) or 3.21.7 (for 3.x projects); these are the vendor-confirmed fixed releases per GHSA-c9cv-mq2m-ppp3. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Open Redirect

View all

CVE-2017-1000117 HIGH Act Now POC

8.8 Oct 05

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca

CVE-2024-52875 HIGH Act Now POC

8.8 Jan 31

GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of

CVE-2016-5385 HIGH Act Now POC

8.1 Jul 19

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect

CVE-2013-2248 MEDIUM This Month POC

5.8 Jul 20

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to

CVE-2012-6499 MEDIUM This Month POC

5.8 Jan 12

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows

CVE-2015-2863 MEDIUM This Month POC

4.3 Jul 20

Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b

CVE-2017-3528 MEDIUM This Month POC

5.4 Apr 24

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li

CVE-2012-0518 MEDIUM Act Now

4.7 Oct 16

Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3

CVE-2024-21641 MEDIUM This Month POC

6.5 Jan 05

Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp

CVE-2015-5354 MEDIUM This Month POC

5.8 Jul 01

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites

CVE-2015-5461 MEDIUM This Month POC

6.4 Jul 08

Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for

CVE-2024-22891 CRITICAL Act Now POC

9.8 Mar 01

Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit

Same weakness CWE-601 – URL Redirection to Untrusted Site (Open Redirect)

View all

CVE-2017-1000117 HIGH POC

8.8

CVE-2016-5385 HIGH POC

8.1

CVE-2017-3528 MEDIUM POC

5.4

CVE-2012-0518 MEDIUM

4.7

CVE-2024-21641 MEDIUM POC

6.5

CVE-2015-5354 MEDIUM POC

5.8

CVE-2024-22891 CRITICAL POC

9.8

CVE-2022-40083 CRITICAL POC

9.6

CVE-2026-56326 vulnerability details – vuln.today

Back