Unauthorized session creation via reserved framework path access
Priority LOW 30CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.
Summary
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization. Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00445 38th percentileScored 2026-11-07
Fix Partial flow (vaadin): 25.0.1com.vaadin:flow-server (Maven): 14.14.1, 23.6.7, 24.9.8 +1+1 more productRed Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | vaadin | 10.0.0 – 14.14.0; 15.0.0 – 23.6.6; 24.0.0 – 24.9.7; 25.0.0 – 25.0.1 | — | No fix listed | CNA |
| Vaadin | flow | 1.0.0 – 2.13.0; 3.0.0 – 23.6.7; 24.0.0 – 24.9.7; 25.0.0 to before 25.0.1 | 25.0.1 | Patch available | CNA |
| — | com.vaadin:flow-server (Maven) | before 14.14.1 | 14.14.1 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:flow-server (Maven) | 23.0.0 to before 23.6.7 | 23.6.7 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:flow-server (Maven) | 24.0.0 to before 24.9.8 | 24.9.8 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:flow-server (Maven) | 25.0.0 to before 25.0.2 | 25.0.2 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:vaadin (Maven) | 25.0.0 to before 25.0.2 | 25.0.2 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:vaadin (Maven) | 24.0.0 to before 24.9.8 | 24.9.8 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:vaadin (Maven) | 23.0.0 to before 23.6.7 | 23.6.7 | Patch available | GHSA-rjgh-wgc7-m37j |
| — | com.vaadin:vaadin (Maven) | before 14.14.1 | 14.14.1 | Patch available | GHSA-rjgh-wgc7-m37j |
- vaadin VendorVaadin Affected 10.0.0 – 14.14.0; 15.0.0 – 23.6.6; 24.0.0 – 24.9.7; 25.0.0 – 25.0.1 Fixed in — No fix listed CNA
- flow VendorVaadin Affected 1.0.0 – 2.13.0; 3.0.0 – 23.6.7; 24.0.0 – 24.9.7; 25.0.0 to before 25.0.1 Fixed in 25.0.1 Patch available CNA
- com.vaadin:flow-server (Maven) Vendor— Affected before 14.14.1 Fixed in 14.14.1 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:flow-server (Maven) Vendor— Affected 23.0.0 to before 23.6.7 Fixed in 23.6.7 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:flow-server (Maven) Vendor— Affected 24.0.0 to before 24.9.8 Fixed in 24.9.8 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:flow-server (Maven) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:vaadin (Maven) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:vaadin (Maven) Vendor— Affected 24.0.0 to before 24.9.8 Fixed in 24.9.8 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:vaadin (Maven) Vendor— Affected 23.0.0 to before 23.6.7 Fixed in 23.6.7 Patch available GHSA-rjgh-wgc7-m37j
- com.vaadin:vaadin (Maven) Vendor— Affected before 14.14.1 Fixed in 14.14.1 Patch available GHSA-rjgh-wgc7-m37j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 10.0.0 to before 14.14.1; 15.0.0 to before 23.6.7; 24.0.0 to before 24.9.8; 25.0.0 to before 25.0.2 | Vulnerable | Vaadin |
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 10.0.0 to before 14.14.1; 15.0.0 to before 23.6.7; 24.0.0 to before 24.9.8; 25.0.0 to before 25.0.2 Vulnerable ·Vaadin
Remediation
- Fix · CNA flow (vaadin) Fixed in 25.0.1
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:flow-server (Maven) Fixed in 14.14.1 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:flow-server (Maven) Fixed in 23.6.7 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:flow-server (Maven) Fixed in 24.9.8 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:flow-server (Maven) Fixed in 25.0.2 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:vaadin (Maven) Fixed in 25.0.2 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:vaadin (Maven) Fixed in 24.9.8 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:vaadin (Maven) Fixed in 23.6.7 Advisory →
- Fix · GHSA-rjgh-wgc7-m37j com.vaadin:vaadin (Maven) Fixed in 14.14.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2742
- 2026-10-03 Alias added: GHSA-rjgh-wgc7-m37j
References
Patch 6
More Vaadin vulnerabilities
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
- TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
- TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
- TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
Sources
- CVE-2026-2742 · CVE Program
- CVE-2026-2742 · NVD
- FIRST EPSS
- GHSA-rjgh-wgc7-m37j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2742 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences