A mass-scanning campaign is actively exploiting a Vite dev server exploit to harvest cloud credentials from internet-exposed development environments, with attackers specifically after AWS and Azure secrets. The vulnerability at the centre of it all, The Hacker News reports, carries a CVSS score of 8.2 and was observed being weaponised throughout August 2026.
The flaw, tracked as CVE-2026-39364, affects Vite versions 7.1.0 through 7.3.2 and the entire 8.x branch prior to 8.0.5. Disclosed on 7 April, it allows an unauthenticated attacker to manipulate query parameters in an HTTP GET request to bypass file read and access controls, pulling files out of restricted locations in plaintext. No authentication, no prior foothold, just a crafted URL.
How the Vite Dev Server Exploit Works
Technology company F5 caught the campaign through its honeypot sensors, logging more than 800 attacks and approximately 32,000 raw events over a month. The mechanics are straightforward. When parameters such as ?raw, ?import&raw, or ?import&url&inline are appended to a request, Vite’s deny-list filtering fails to fire and the server responds with an HTTP 200, handing over whatever file was requested.
F5 observed attackers working through extensive wordlists targeting environment files (.env, .env.production, .env.local), AWS credential files from multiple possible home directories, AWS configuration and credential backups, Azure credentials and access tokens, Terraform state and variable files, serverless configuration files, and low-level Linux paths such as /proc/self/environ and /etc/passwd. The breadth of that list makes clear this is not opportunistic poking around, it is systematic collection.
To slip past reverse proxies and web application firewall normalisation, the operators also tried traversal and encoding variants, including double-encoded traversal sequences. And according to Cyber Security News, requests rotated forged User-Agent strings impersonating Googlebot, ClaudeBot, GPTBot, PerplexityBot, OAI-SearchBot, and Amazonbot, a tidy blend of legitimate crawlers designed to look like background noise rather than an attack.
Wider Infrastructure and the Next.js Connection
F5 found that the most active IP addresses in the campaign also exploited additional Vite access control flaws: CVE-2025-30208, CVE-2025-31125 (flagged as actively exploited), and CVE-2024-45811. The same infrastructure, Cyber Security News notes, also probed CVE-2025-29927, a Next.js middleware authorisation bypass, suggesting the operators are running a broad-spectrum scan across multiple web development frameworks rather than targeting Vite exclusively.
Most of the observed malicious activity originated from IP addresses in the United States, Belgium, and the Netherlands, with the attackers routing through Google Cloud IP ranges for evasion. The three most active source addresses, 34.14.15[.]105, 34.16.200[.]129, and 34.11.196[.]206, should be blocklisted.
Protecting Against the Vite Dev Server Exploit
The root cause of exposure is a common developer habit. Vite normally binds to localhost, but F5 researchers say developers frequently push it online by passing the --host flag, setting server.host, or leaving Docker port mappings misconfigured. The result is a development tool, never designed to face the public internet, sitting fully exposed.
F5’s recommendations are concrete. Update Vite servers to the latest version, which patches the exploited flaws. Block external access through port 5173. Block suspicious /@fs/ requests at the perimeter. Do not trust crawler User-Agent strings as a signal of legitimate traffic, the campaign’s forged bot identities demonstrate exactly why.
For teams running the vulnerable version ranges who have had Vite servers publicly exposed, the advice is to rotate every secret within reach of the compromised system. Given the wordlists being used, that means AWS keys, Azure tokens, and any credentials stored in environment files or Terraform state should be treated as potentially harvested and replaced accordingly.
