This CVE exploits a flaw in how Nuxt's SSR payload caching interacts with authentication. The root cause is that _payload.json cache keys are generated from URL route and query parameters alone—they do not incorporate session or authentication state. When a cached payload exists, Nuxt serves it directly from the cache layer before executing route middleware, which means authorization checks never run for cached responses. An attacker who can predict or enumerate the _payload.json URL for another user's page can retrieve that cached SSR payload without any authentication context.
The real detection gap is that standard security tooling cannot distinguish between legitimate prerender caching and malicious payload enumeration—both traverse the same endpoint and produce identical network traffic. Effective detection requires application-level instrumentation that correlates _payload.json requests with the parent page route's session cookies. If a payload request arrives without a valid session cookie that corresponds to the parent page, that's anomalous.
For remediation, you have two options depending on your architecture. The robust fix is to implement session-partitioned cache keys: incorporate a session hash into the cache key so each authenticated user gets their own cached payload. Alternatively, validate authorization at cache-write time and tag cached entries with their authorization scope. Session cookie correlation at the application layer is a compensating control, not a fix—it detects exploitation but doesn't prevent the underlying bypass. Against timing attacks where an attacker requests a payload immediately after an authenticated user (before the session expires), correlation alone will fail.
Check your Nuxt configuration for routes with both _payload.json caching enabled and authenticated SSR components. Any route serving user-specific state through the payload endpoint is vulnerable until the cache key design is updated.