CVE-2026-2742
Unauthorized session creation via reserved framework path access
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Unauthorized session creation via reserved framework path access
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
- Record
CVE-2026-2742- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-10498
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
- Record
EUVD-2026-10498- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rjgh-wgc7-m37j
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
- Record
GHSA-rjgh-wgc7-m37j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
- Record
CVE-2026-2742- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Unauthorized session creation via reserved framework path access
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
- Record
CVE-2026-2742- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-rjgh-wgc7-m37j
Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.
- Record
GHSA-rjgh-wgc7-m37j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-serverMaven |
before 14.14.1 | 14.14.1 |
com.vaadin:flow-serverMaven |
23.0.0 up to 23.6.7 | 23.6.7 |
com.vaadin:flow-serverMaven |
24.0.0 up to 24.9.8 | 24.9.8 |
com.vaadin:flow-serverMaven |
25.0.0 up to 25.0.2 | 25.0.2 |
com.vaadin:vaadinMaven |
25.0.0 up to 25.0.2 | 25.0.2 |
com.vaadin:vaadinMaven |
24.0.0 up to 24.9.8 | 24.9.8 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.6.7 | 23.6.7 |
com.vaadin:vaadinMaven |
before 14.14.1 | 14.14.1 |
com.vaadin:flow-serverMaven |
before 14.14.1, plus listed versions 1.0.01.0.11.0.101.0.111.0.12 Show 45 moreShow less1.0.131.0.141.0.151.0.161.0.171.0.181.0.191.0.21.0.201.0.211.0.221.0.231.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.2.01.2.11.2.21.2.31.2.41.2.51.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.82.0.02.0.12.0.102.0.112.0.122.0.132.0.142.0.152.0.16 |
14.14.1 |
com.vaadin:flow-serverMaven |
23.0.0 up to 23.6.7, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.223.1.323.1.423.1.523.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.223.2.323.2.423.2.523.2.623.2.723.2.823.2.923.3.023.3.123.3.1023.3.1123.3.1223.3.1323.3.1423.3.1523.3.1623.3.1723.3.18 |
23.6.7 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:flow-serverMaven |
24.0.0 up to 24.9.8, plus listed versions 24.0.124.0.1024.0.1124.0.1224.0.13 Show 45 moreShow less24.0.1424.0.1524.0.1624.0.1724.0.224.0.324.0.424.0.524.0.624.0.724.0.824.0.924.1.024.1.124.1.1024.1.1124.1.1224.1.1324.1.1424.1.1524.1.1624.1.1724.1.1824.1.1924.1.224.1.2024.1.2124.1.2224.1.324.1.424.1.524.1.624.1.724.1.824.1.924.2.024.2.124.2.1024.2.1124.2.1224.2.1324.2.224.2.324.2.424.2.5 |
24.9.8 |
com.vaadin:flow-serverMaven |
25.0.0 up to 25.0.2, plus listed versions 25.0.1 |
25.0.2 |
com.vaadin:vaadinMaven |
24.0.0 up to 24.9.8, plus listed versions 24.0.124.0.1024.0.1124.0.1224.0.13 Show 45 moreShow less24.0.1424.0.1524.0.224.0.324.0.424.0.524.0.624.0.724.0.824.0.924.1.024.1.124.1.1024.1.1124.1.1224.1.1324.1.1424.1.1524.1.1624.1.1724.1.1824.1.224.1.324.1.424.1.524.1.624.1.724.1.824.1.924.2.024.2.124.2.1024.2.1124.2.1224.2.1324.2.224.2.324.2.424.2.524.2.624.2.724.2.824.2.924.3.024.3.1 |
24.9.8 |
com.vaadin:vaadinMaven |
23.0.0 up to 23.6.7, plus listed versions 23.0.123.0.1023.0.1123.0.1223.0.13 Show 45 moreShow less23.0.1423.0.1523.0.1623.0.223.0.323.0.423.0.523.0.623.0.723.0.823.0.923.1.023.1.123.1.1023.1.1123.1.1223.1.1323.1.1423.1.1523.1.1623.1.1723.1.223.1.323.1.423.1.623.1.723.1.823.1.923.2.023.2.123.2.1023.2.1123.2.1223.2.1323.2.1423.2.1523.2.1623.2.1723.2.223.2.323.2.423.2.523.2.623.2.723.2.8 |
23.6.7 |
com.vaadin:vaadinMaven |
before 14.14.1, plus listed versions 10.0.010.0.110.0.1010.0.1110.0.12 Show 45 moreShow less10.0.1310.0.1410.0.1510.0.1610.0.1710.0.1810.0.1910.0.210.0.2010.0.2110.0.2210.0.2310.0.2410.0.2510.0.2610.0.310.0.410.0.510.0.610.0.710.0.810.0.911.0.011.0.111.0.211.0.311.0.412.0.012.0.112.0.212.0.312.0.412.0.512.0.612.0.713.0.013.0.113.0.1013.0.1113.0.1213.0.1313.0.213.0.313.0.413.0.5 |
14.14.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2742 is a medium vulnerability (CVSS 5.3) in Vaadin, published March 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in com.vaadin:flow-server 14.14.1.
References
Left out here: 840 versions. The JSON record has them.