AIKIDO-2026-10948

TL;DR

When component islands are enabled, .server.vue pages under pages/ are registered as page_* islands and reachable at /__nuxt_island/page_* URLs. Before the fix, those requests rendered through the SSR path without running Vue Router middleware, so authentication enforced only via route middleware could be bypassed. An unauthenticated attacker could request the island URL directly and receive server-rendered protected HTML. The fix runs middleware and redirect handling for page islands and rejects invalid page paths.