Nuxt 4 and 3 earlier releases contain a flaw that allows attackers to supply protocol‑relative URLs to the reloadNuxtApp function. Those URLs, such as //evil.com, bypass the script‑protocol validation but resolve to a different origin under the current protocol. When processed, the function redirects the browser, enabling attackers to send end users to attacker‑controlled sites. This can be exploited for phishing or to hijack OAuth authorization codes. The weakness is a typical open‑redirect scenario (CWE‑601).

The vulnerability affects the Nuxt web framework, specifically versions 4.0.0 through 4.4.6 and 3.x through 3.21.6. Systems running a Nuxt application that rely on the reloadNuxtApp helper and target those version ranges are at risk. The affected codebase is hosted on Node.js environments and would need to be updated accordingly.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, so the likelihood of exploitation cannot be quantified. The issue is not currently listed in CISA’s KEV catalog. Because the redirect occurs client‑side, an attacker can craft a malicious link that a user clicks to trigger the redirect, making phishing a realistic threat vector. Remote users who visit an attacker‑controlled page can be redirected to malicious domains when the target application processes the protocol‑relative URL.