EUVD-2026-38375Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no privileges required; user must click a crafted link; scope changes as redirect impacts a cross-origin system receiving stolen credentials.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 contain a server-side open redirect vulnerability in navigateTo that fails to properly validate path-normalized payloads like /..//evil.com and /.//evil.com. Attackers can bypass external-host checks using path-normalization techniques to redirect users to attacker-controlled sites via the Location header or meta-refresh, enabling phishing and OAuth authorization-code theft.
AnalysisAI
Server-side open redirect in Nuxt's navigateTo composable allows unauthenticated network attackers to bypass external-host checks by submitting path-normalized payloads such as /..//evil.com or /.//evil.com, which WHATWG URL parsing resolves to the protocol-relative URL //evil.com. Affected versions are Nuxt 4.0.0-4.4.6 and all 3.x releases before 3.21.7. Because Nuxt documentation presents navigateTo as the safe, built-in mechanism for post-login redirects, applications commonly pass unvalidated user-supplied redirect parameters directly to it - making OAuth authorization-code theft and phishing the principal real-world risks. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV.
Technical ContextAI
Nuxt is a Vue.js full-stack framework distributed as the npm package nuxt (CPE: cpe:2.3:a:nuxt:nuxt:*:*:*:*:*:*:*:*). The affected function, navigateTo, is a first-party composable used for programmatic navigation and is explicitly documented as the safe path for post-login redirects. During server-side rendering, navigateTo evaluated whether a redirect target was external using hasProtocol(..., { acceptRelative: true }) against the raw input. Because inputs such as /..//evil.com start with /, they passed the same-origin check; however, WHATWG URL parsing subsequently normalized these paths to the protocol-relative form //evil.com. The normalized value was then written verbatim into the HTTP Location response header and into <meta http-equiv='refresh'> content on the SSR redirect page, causing browsers to resolve the redirect cross-origin. The root cause class is CWE-601 (URL Redirection to Untrusted Site / Open Redirect) - specifically, incomplete validation of redirect destinations due to failure to account for URL normalization semantics applied by the runtime. The patch collapses leading double-slashes in normalized pathnames to enforce same-origin constraints before writing to HTTP headers.
RemediationAI
Upgrade the nuxt npm package to version 4.4.7 (for 4.x projects) or 3.21.7 (for 3.x projects); these are the vendor-confirmed fixed releases per GHSA-c9cv-mq2m-ppp3. The underlying fixes are delivered via commit https://github.com/nuxt/nuxt/commit/2cce6fb02e621196d56df92e05594e07469b5a6d (router composable patch) and https://github.com/nuxt/nuxt/commit/1f2dd5e78c77576437138e97671965573c232835, addressing pull requests https://github.com/nuxt/nuxt/pull/35115 and https://github.com/nuxt/nuxt/pull/35206. If an immediate upgrade is not feasible, applications should sanitize all user-supplied redirect parameters at the application layer before passing them to navigateTo, explicitly rejecting any input whose WHATWG-normalized form begins with // or resolves to a different origin than the application. An allowlist of permitted redirect paths or domains is the most robust compensating control; a blocklist approach is prone to bypass variants and is not recommended as a standalone mitigation. Note that the GHSA advisory also documents two related weaknesses - client-side XSS via navigateTo({ open: ... }) and an open redirect in reloadNuxtApp - which are patched in the same releases and should be addressed concurrently.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today