A vulnerability in @nuxt/vite-builder versions 4.6.0 through before 4.6.3 allows exposure of a generated development appSecret via the Nuxt dev server's file serving. This secret enables forging session cookies if accessed. The issue affects dev servers exposed to untrusted networks but not production builds or dev servers with explicitly configured appSecrets. It is fixed in version 4.6.3.