CVE-2026-123808 Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native...

CVE-2026-123808

The Nuxt UI Vue UI library (prior to version 4.8.1 ) contains a vulnerability where the server-rendered form element produced by UForm (located in src/runtime/components/Form.vue) omits the method and action attributes. The component relies entirely on a hydrated @submit.prevent handler to block ...

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Summary UForm and UAuthForm render a server-side element with no method and no action attribute, relying on a hydrated @submit.prevent handler to intercept submission. If a user submits the form before Vue hydration has attached the handler autofill plus Enter on a slow network, JS bundle blocked...

CVE-2024-55922

CVE-2024-55922 is a CSRF vulnerability in TYPO3’s backend UI deep-link functionality affecting the Form Framework Module. The issue allows an attacker to manipulate or delete persisted form definitions when a victim with an active backend session is deceived into visiting a malicious URL. Conditi...