Read the docs
TI-2026-81073 Aliases CVE-2026-110737

Vaadin push endpoint reflects any Origin and allows credentials

Priority MEDIUM 45CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Vaadin applications that use server push (@Push) are affected, including Vaadin Framework from 7.1.0 before 7.7.55 and from 8.0.0 before 8.32.2. The push endpoint reflects the request Origin into the Access-Control-Allow-Origin header and allows credentials, which is an origin validation error (CWE-346). A page on any origin can make a cross-origin request that carries the user's cookies and read the response, though reading useful data also requires the session's push identifier.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1 Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Artifacts under com.vaadin Maven coordinates / Vulnerable versions / Fixed version vaadin / 14.14.0 - 14.14.7 / >=14.14.8 vaadin / 23.6.0 - 23.6.16 / >=23.6.17 vaadin / 24.4.0 - 24.4.25 / >=24.4.26 vaadin / 24.5.0 - 24.5.15 / >=24.7.17 vaadin / 24.6.0 - 24.6.13 / >=24.7.17 vaadin / 24.7.0 - 24.7.16 / >=24.7.17 vaadin / 24.8.0 - 24.8.17 / >=24.9.24 vaadin / 24.9.0 - 24.9.23 / >=24.9.24 vaadin / 24.10.0 - 24.10.11 / >=24.10.12 vaadin / 25.0.0 - 25.0.13 / >=25.2.11 vaadin / 25.1.0 - 25.1.13 / >=25.2.11 vaadin / 25.2.0 - 25.2.10 / >=25.2.11 vaadin / 25.3.0 - 25.3.2 / >=25.3.3 vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 flow-server / 2.13.0 - 2.13.7 / >=2.13.8 flow-server / 23.6.0 - 23.6.15 / >=23.6.16 flow-server / 24.4.0 - 24.4.18 / >=24.4.19 flow-server / 24.5.0 - 24.5.17 / >=24.7.17 flow-server / 24.6.0 - 24.6.14 / >=24.7.17 flow-server / 24.7.0 - 24.7.15 / >=24.7.16 flow-server / 24.8.0 - 24.8.16 / >=24.9.24 flow-server / 24.9.0 - 24.9.28 / >=24.9.29 flow-server / 24.10.0 - 24.10.14 / >=24.10.15 flow-server / 25.0.0 - 25.0.15 / >=25.2.11 flow-server / 25.1.0 - 25.1.18 / >=25.1.19 flow-server / 25.2.0 - 25.2.12 / >=25.2.13 flow-server / 25.3.0 - 25.3.3 / >=25.3.4 vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed vaadin (vaadin): 14.14.8, 23.6.17, 24.4.26 +5flow (vaadin): 2.13.8, 23.6.16, 24.4.19 +6+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vaadinvaadin14.14.0 to before 14.14.8; 23.6.0 to before 23.6.17; 24.4.0 to before 24.4.26; 24.5.0 – 24.5.15; 24.6.0 – 24.6.13; 24.7.0 to before 24.7.17; 24.8.0 – 24.8.17; 24.9.0 to before 24.9.24; 24.10.0 to before 24.10.12; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.11; 25.3.0 to before 25.3.314.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3Patch availableCNA
Vaadinvaadin14.14.0 to before 14.14.8; 23.6.0 to before 23.6.17; 24.4.0 to before 24.4.26; 24.5.0 – 24.5.15; 24.6.0 – 24.6.13; 24.7.0 to before 24.7.17; 24.8.0 – 24.8.17; 24.9.0 to before 24.9.24; 24.10.0 to before 24.10.12; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.11; 25.3.0 to before 25.3.314.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3Patch availableCNA
Vaadinflow2.13.0 to before 2.13.8; 23.6.0 to before 23.6.16; 24.4.0 to before 24.4.19; 24.5.0 – 24.5.17; 24.6.0 – 24.6.14; 24.7.0 to before 24.7.16; 24.8.0 – 24.8.16; 24.9.0 to before 24.9.29; 24.10.0 to before 24.10.15; 25.0.0 – 25.0.15; 25.1.0 to before 25.1.19; 25.2.0 to before 25.2.13; 25.3.0 to before 25.3.42.13.8, 23.6.16, 24.4.19, 24.7.16, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4Patch availableCNA
Vaadinframework7.1.0 to before 7.7.55; 8.0.0 to before 8.32.27.7.55, 8.32.2Patch availableCNA
Vaadinframework7.7.36 to before 7.7.55; 8.18.0 to before 8.32.27.7.55, 8.32.2Patch availableCNA
  • vaadin VendorVaadin Affected 14.14.0 to before 14.14.8; 23.6.0 to before 23.6.17; 24.4.0 to before 24.4.26; 24.5.0 – 24.5.15; 24.6.0 – 24.6.13; 24.7.0 to before 24.7.17; 24.8.0 – 24.8.17; 24.9.0 to before 24.9.24; 24.10.0 to before 24.10.12; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.11; 25.3.0 to before 25.3.3 Fixed in 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3 Patch available CNA
  • vaadin VendorVaadin Affected 14.14.0 to before 14.14.8; 23.6.0 to before 23.6.17; 24.4.0 to before 24.4.26; 24.5.0 – 24.5.15; 24.6.0 – 24.6.13; 24.7.0 to before 24.7.17; 24.8.0 – 24.8.17; 24.9.0 to before 24.9.24; 24.10.0 to before 24.10.12; 25.0.0 – 25.0.13; 25.1.0 – 25.1.13; 25.2.0 to before 25.2.11; 25.3.0 to before 25.3.3 Fixed in 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3 Patch available CNA
  • flow VendorVaadin Affected 2.13.0 to before 2.13.8; 23.6.0 to before 23.6.16; 24.4.0 to before 24.4.19; 24.5.0 – 24.5.17; 24.6.0 – 24.6.14; 24.7.0 to before 24.7.16; 24.8.0 – 24.8.16; 24.9.0 to before 24.9.29; 24.10.0 to before 24.10.15; 25.0.0 – 25.0.15; 25.1.0 to before 25.1.19; 25.2.0 to before 25.2.13; 25.3.0 to before 25.3.4 Fixed in 2.13.8, 23.6.16, 24.4.19, 24.7.16, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4 Patch available CNA
  • framework VendorVaadin Affected 7.1.0 to before 7.7.55; 8.0.0 to before 8.32.2 Fixed in 7.7.55, 8.32.2 Patch available CNA
  • framework VendorVaadin Affected 7.7.36 to before 7.7.55; 8.18.0 to before 8.32.2 Fixed in 7.7.55, 8.32.2 Patch available CNA

Remediation

Upgrade Vaadin (vaadin) to 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11 or 25.3.3. Upgrade Vaadin Flow (flow) to 2.13.8, 23.6.16, 24.4.19, 24.7.16, 24.9.29, 24.10.15, 25.1.19, 25.2.13 or 25.3.4. Upgrade Vaadin Framework to 7.7.55 or 8.32.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA vaadin (vaadin) Fixed in 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3
  • Fix · CNA vaadin (vaadin) Fixed in 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3
  • Fix · CNA flow (vaadin) Fixed in 2.13.8, 23.6.16, 24.4.19, 24.7.16, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4
  • Fix · CNA framework (vaadin) Fixed in 7.7.55, 8.32.2
  • Fix · CNA framework (vaadin) Fixed in 7.7.55, 8.32.2

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-110737
  2. 2026-11-04 CISA SSVC decision points changed
  3. 2026-11-04 Priority changed: LOW → MEDIUM

References

Other 3

  • TI-2026-78950 Session lock leak in Vaadin Framework 8 allows denial of service CVSS 4.0HIGH 8.7
  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
  • TI-2026-78949 Multiple flaws in Highcharts bundled with Vaadin Charts CVSS 4.0HIGH 8.4
  • TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
  • TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences