The vulnerability in @nuxt/ui's UForm and UAuthForm components arises because server-side rendered forms omit the method attribute and rely on a Vue hydration handler to prevent native form submission. If the form is submitted before hydration (e.g., due to slow network or JS blocking), the browser performs a default GET request, including sensitive fields like passwords in the URL query string. This leads to credential leakage via the URL, browser history, Referer headers, and logs. The recommended fix is to default the form's method attribute to POST to ensure safe fallback behavior prior to hydration.

Credentials, including passwords, can be exposed in cleartext in the URL query string if a form is submitted before Vue hydration attaches the submit handler. This exposure affects the browser address bar, window history, Referer headers sent to same-origin resources, and any server or proxy logs that record URLs. This leakage risks unauthorized disclosure of sensitive authentication data.

A patch is available that sets the form's method attribute to POST by default, preventing credential leakage during the hydration race window. Applications can opt back into GET submissions by explicitly specifying method="get". Users should upgrade to a version where this fix is applied or manually set method="post" on forms using UForm or UAuthForm to mitigate the issue.