Threats tagged 'ghsa-r8g5-gwcc-5r5r'

Nuxt versions from 4.6.0 up to but not including 4.6.2 contain a route parameter confusion vulnerability in the getRouterParam and getRouterParams functions. This flaw allows attackers to send paths with encoded question marks (%3F) to obtain parameter values different from those matched by the h3 router. As a result, attackers can craft requests where authorization checks rely on the Nuxt helper value, while resource selection uses event.context.params, potentially granting unauthorized access to resources.