CVE-2026-2742

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2742
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2742.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2742
Aliases
Published
2026-03-10T12:08:48Z
Modified
2026-10-22T07:28:34Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber CVSS Calculator
Summary
Unauthorized session creation via reserved framework path access
Details

An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.

Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.

Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

Database specific 
{
    "cna_assigner":  "Vaadin",
    "cwe_ids":  [
        "CWE-284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2742.json"
}
References

Affected packages

Git / github.com/vaadin/flow

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
90076b751b26030a271942c3d523b732ced97219
Introduced
f5bd08834302a4f461b920dea6d0be8808e88a50
Fixed
c376b4e8a9991df767172e3fef4dabe059178a68
Introduced
d3e5f6448dd0563cd62137836ea4fd5be69c9067
Fixed
d50248fd4f0d9b50b784db977f72c22edc22e82e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "15.0.0"
                },
                {
                    "fixed":  "23.6.7"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "24.0.0"
                },
                {
                    "fixed":  "24.9.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "25.0.0"
                },
                {
                    "fixed":  "25.0.2"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/vaadin/platform
Events
Introduced
8e1b5f1a3f9bb984108d172f19d4d2df4a1987f5
Last Affected
1898285e7447335f6f89b45505e3e580f123ccb9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "10.0.0"
                },
                {
                    "last_affected":  "14.14.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
1.*
1.0.0
1.0.0.alpha1
1.0.0.alpha10
1.0.0.alpha11
1.0.0.alpha12
1.0.0.alpha13
1.0.0.alpha14
1.0.0.alpha15
1.0.0.alpha16
1.0.0.alpha17
1.0.0.alpha18
1.0.0.alpha19
1.0.0.alpha2
1.0.0.alpha20
1.0.0.alpha21
1.0.0.alpha22
1.0.0.alpha23
1.0.0.alpha3
1.0.0.alpha4
1.0.0.alpha5
1.0.0.alpha6
1.0.0.alpha7
1.0.0.alpha8
1.0.0.alpha9
1.0.0.beta1
1.0.0.beta10
1.0.0.beta11
1.0.0.beta12
1.0.0.beta2
1.0.0.beta3
1.0.0.beta4
1.0.0.beta5
1.0.0.beta6
1.0.0.beta7
1.0.0.beta8
1.0.0.beta9
1.0.0.rc1
1.0.0.rc2
1.0.0.rc3
1.0.0.rc4
1.0.0.rc5
1.1.0
1.1.0.alpha1
1.1.0.alpha2
1.1.0.alpha3
1.1.0.beta1
1.1.0.beta2
1.1.0.beta3
1.1.0.beta4
1.2.0
1.2.0.alpha1
1.2.0.beta1
1.2.0.beta2
1.3.0.alpha2
1.3.0.alpha3
1.5.0.alpha1
1.5.0.alpha2
1.5.0.alpha3
1.5.0.alpha4
10.*
10.0.0
10.0.0.alpha1
10.0.0.alpha2
10.0.0.alpha3
10.0.0.alpha4
10.0.0.alpha5
10.0.0.beta1
10.0.1
10.0.2
11.*
11.0.0.alpha1
11.0.0.beta1
12.*
12.0.0.alpha1
12.0.0.alpha2
12.0.0.alpha3
12.0.0.alpha4
12.0.0.alpha5
12.0.0.beta1
12.0.0.beta2
13.*
13.0.0
13.0.0.alpha1
13.0.0.alpha2
13.0.0.alpha3
13.0.0.alpha4
13.0.0.beta1
13.0.0.beta2
13.0.0.beta3
13.0.1
14.*
14.0.0
14.0.0.alpha1
14.0.0.alpha2
14.0.0.alpha3
14.0.0.alpha4
14.0.0.beta1
14.0.0.beta2
14.0.0.beta3
14.0.0.rc1
14.0.0.rc2
14.0.0.rc3
14.0.0.rc4
14.0.0.rc5
14.0.0.rc6
14.0.0.rc7
14.0.0.rc9
14.0.1
14.0.2
14.1.0
14.1.0.alpha1
14.1.0.alpha3
14.1.0.beta1
14.1.0.beta2
14.1.1
14.1.2
14.10.0
14.10.0.alpha1
14.10.0.alpha2
14.10.0.alpha3
14.10.0.beta1
14.10.1
14.10.2
14.10.3
14.11.0
14.11.0.alpha1
14.11.0.alpha2
14.11.1
14.11.10
14.11.11
14.11.2
14.11.3
14.11.4
14.11.5
14.11.6
14.11.7
14.11.8
14.11.9
14.12.0
14.12.0.alpha1
14.12.0.beta1
14.12.0.rc1
14.12.1
14.12.2
14.12.3
14.12.4
14.12.5
14.12.6
14.12.7
14.12.8
14.13.0
14.13.0.alpha1
14.13.1
14.13.2
14.14.0
14.14.0-beta1
14.2.0
14.2.0.alpha1
14.2.0.alpha10
14.2.0.alpha11
14.2.0.alpha2
14.2.0.alpha3
14.2.0.alpha4
14.2.0.alpha5
14.2.0.alpha6
14.2.0.alpha7
14.2.0.alpha8
14.2.0.alpha9
14.2.0.beta1
14.2.0.rc1
14.3.0
14.3.0.alpha1
14.3.0.beta1
14.3.0.beta2
14.3.0.beta3
14.3.0.rc1
14.4.0
14.4.0.alpha1
14.4.0.beta1
14.4.0.beta2
14.4.0.rc1
14.5.0.alpha1
14.5.0.alpha2
14.5.0.alpha3
14.5.0.beta1
14.5.0.rc1
14.6.0.alpha1
14.6.0.alpha2
14.6.0.beta1
14.6.0.beta2
14.7.0
14.7.0.alpha1
14.7.0.alpha2
14.7.0.alpha3
14.7.0.beta1
14.7.0.rc1
14.8.0
14.8.0.alpha1
14.8.0.beta1
14.8.1
14.8.10
14.8.11
14.8.12
14.8.13
14.8.14
14.8.15
14.8.16
14.8.17
14.8.2
14.8.3
14.8.4
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
14.9.0
14.9.0.alpha1
14.9.0.beta1
14.9.0.rc1
14.9.1
14.9.2
14.9.3
14.9.4
2.*
2.0.0
2.0.0.alpha5
2.0.0.beta1
2.0.0.beta2
2.0.0.rc1
2.0.0.rc2
2.0.0.rc3
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0.alpha1
2.1.0.beta1
2.1.0.beta3
2.2.0.alpha1
2.2.0.alpha10
2.2.0.alpha2
2.2.0.alpha3
2.2.0.alpha4
2.2.0.alpha5
2.2.0.alpha6
2.2.0.alpha7
2.2.0.alpha8
2.2.0.alpha9
23.*
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4
23.1.0.beta1
23.2.0
23.2.0.alpha1
23.2.0.alpha2
23.2.0.beta1
23.2.0.beta2
23.2.0.beta3
23.2.0.rc1
23.2.0.rc2
23.3.0
23.3.0.alpha1
23.3.0.alpha2
23.3.0.alpha3
23.3.0.beta1
23.3.0.beta2
23.3.0.beta3
23.3.0.beta4
23.3.0.rc1
23.3.0.rc2
23.3.1
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.2
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.4.0
23.4.0.alpha1
23.4.0.alpha2
23.4.0.beta1
23.5.0
23.5.0.alpha1
23.5.0.alpha2
23.5.1
23.5.10
23.5.11
23.5.12
23.5.13
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.6.0
23.6.0.alpha1
23.6.0.alpha2
23.6.0.alpha3
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5
23.6.6
24.*
24.0.0.alpha10
24.0.0.alpha11
24.0.0.alpha12
24.0.0.alpha13
24.0.0.alpha14
24.0.0.alpha15
24.0.0.alpha16
24.0.0.alpha17
24.0.0.alpha3
24.0.0.alpha4
24.0.0.alpha5
24.0.0.alpha6
24.0.0.alpha7
24.0.0.alpha8
24.0.0.alpha9
24.0.0.beta1
24.1.0.alpha1
24.1.0.alpha2
24.1.0.alpha3
24.1.0.alpha4
24.1.0.alpha5
24.1.0.alpha6
24.1.0.alpha7
24.1.0.alpha8
24.1.0.beta1
24.2.0.alpha1
24.2.0.alpha2
24.2.0.alpha3
24.2.0.alpha4
24.2.0.alpha5
24.2.0.alpha6
24.2.0.alpha7
24.2.0.alpha8
24.2.0.alpha9
24.2.0.beta1
24.3.0.alpha1
24.3.0.alpha2
24.3.0.alpha3
24.3.0.alpha4
24.3.0.alpha5
24.3.0.alpha6
24.3.0.alpha7
24.3.0.beta1
24.4.0.alpha1
24.4.0.alpha10
24.4.0.alpha11
24.4.0.alpha12
24.4.0.alpha13
24.4.0.alpha14
24.4.0.alpha15
24.4.0.alpha16
24.4.0.alpha17
24.4.0.alpha18
24.4.0.alpha19
24.4.0.alpha2
24.4.0.alpha20
24.4.0.alpha21
24.4.0.alpha22
24.4.0.alpha23
24.4.0.alpha24
24.4.0.alpha25
24.4.0.alpha26
24.4.0.alpha27
24.4.0.alpha28
24.4.0.alpha29
24.4.0.alpha3
24.4.0.alpha30
24.4.0.alpha31
24.4.0.alpha32
24.4.0.alpha4
24.4.0.alpha5
24.4.0.alpha6
24.4.0.alpha7
24.4.0.alpha8
24.4.0.alpha9
24.4.0.beta1
24.5.0.alpha1
24.5.0.alpha10
24.5.0.alpha11
24.5.0.alpha12
24.5.0.alpha13
24.5.0.alpha14
24.5.0.alpha15
24.5.0.alpha16
24.5.0.alpha17
24.5.0.alpha18
24.5.0.alpha19
24.5.0.alpha2
24.5.0.alpha20
24.5.0.alpha3
24.5.0.alpha4
24.5.0.alpha5
24.5.0.alpha6
24.5.0.alpha7
24.5.0.alpha8
24.5.0.alpha9
24.5.0.beta1
24.6.0.alpha1
24.6.0.alpha2
24.6.0.alpha3
24.6.0.alpha4
24.6.0.alpha5
24.6.0.alpha6
24.6.0.beta1
24.6.0.beta2
24.6.0.beta3
24.7.0.alpha1
24.7.0.alpha10
24.7.0.alpha11
24.7.0.alpha12
24.7.0.alpha13
24.7.0.alpha14
24.7.0.alpha15
24.7.0.alpha2
24.7.0.alpha3
24.7.0.alpha4
24.7.0.alpha5
24.7.0.alpha6
24.7.0.alpha7
24.7.0.alpha8
24.7.0.alpha9
24.7.0.beta1
24.8.0
24.8.0.alpha1
24.8.0.alpha10
24.8.0.alpha11
24.8.0.alpha12
24.8.0.alpha13
24.8.0.alpha14
24.8.0.alpha15
24.8.0.alpha2
24.8.0.alpha3
24.8.0.alpha4
24.8.0.alpha5
24.8.0.alpha6
24.8.0.alpha7
24.8.0.alpha8
24.8.0.alpha9
24.8.0.beta1
24.8.0.beta2
24.8.0.beta3
24.8.0.beta4
24.8.0.rc1
24.8.0.rc2
24.9.0
24.9.0-alpha1
24.9.0-alpha2
24.9.0-alpha3
24.9.0-alpha4
24.9.0-alpha5
24.9.0-alpha6
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
25.*
25.0.0
25.0.1
3.*
3.0.0.alpha17
3.0.0.alpha5
3.0.0.beta1
3.0.0.beta2
3.0.0.beta3
3.0.0.beta4
3.2.0.alpha1
3.2.0.alpha2
3.2.0.alpha3
3.2.0.alpha4
3.2.0.alpha5
3.2.0.alpha6
3.2.0.alpha7
4.*
4.0.0.alpha1
4.0.0.alpha2
4.0.0.alpha3
4.0.0.beta1
5.*
5.0.0.alpha1
5.0.0.beta1
6.*
6.0.0.alpha1
6.0.0.alpha2
6.0.0.alpha3
6.0.0.alpha4
6.0.0.alpha5
6.0.0.beta1
7.*
7.0.0.alpha1
7.0.0.alpha2
7.0.0.alpha3
7.0.0.alpha4
7.0.0.alpha5
7.0.0.alpha6
7.0.0.alpha7
7.0.0.beta1
8.*
8.0.0.alpha1
8.0.0.alpha10
8.0.0.alpha2
8.0.0.alpha3
8.0.0.alpha4
8.0.0.alpha5
8.0.0.alpha6
8.0.0.alpha7
8.0.0.alpha8
8.0.0.alpha9
9.*
9.0.0.alpha1
9.0.0.alpha10
9.0.0.alpha11
9.0.0.alpha2
9.0.0.alpha3
9.0.0.alpha4
9.0.0.alpha5
9.0.0.alpha6
9.0.0.alpha7
9.0.0.alpha8
9.0.0.alpha9
9.0.0.beta1
9.0.0.beta2
9.0.0.beta3
9.0.0.beta4
9.0.0.rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2742.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "63625341286879514412248931889060187826",
                "270609413968648930133655272856333298131",
                "108367093987876941270903888384989928652",
                "10498160919470108996719504218632220569"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2742-0391cff7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/90076b751b26030a271942c3d523b732ced97219",
        "target":  {
            "file":  "flow-server/src/main/java/com/vaadin/flow/server/Constants.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "215014620752889708167228331724762507408",
            "length":  252
        },
        "id":  "CVE-2026-2742-0db14d2a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/c376b4e8a9991df767172e3fef4dabe059178a68",
        "target":  {
            "file":  "flow-tests/test-frontend/vite-pwa/src/test/java/com/vaadin/viteapp/MainIT.java",
            "function":  "sendVitePingRequest"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "109100375472609832782202292518534151959",
                "50004734319100201203557331672367896690",
                "303582694453691871108587939728057894417",
                "276357806564016881623090534413829705246",
                "83022547110440374372973975429067838690",
                "55493511660129992268951106578473370788",
                "305342217222176447531981096402551810392",
                "242245792450540983003918405059682059951",
                "55997072694634889096175073581841473102",
                "179375489572579749116982619277964032804",
                "64918161202105671804855103630088546855",
                "150594014527342636816541514908100528567",
                "114148076697699149449727750046244911200",
                "196295030324572358498997833507090733147",
                "36451129744073313461982646377051589665",
                "245130307822852606153465330811260948561",
                "99635606472232014936087407573810841639",
                "143032779112796646070643563811441259967",
                "129023271906019924564662561767814040010",
                "181253692207042497685723680082890941249",
                "180165469931480796005699989818448710721",
                "38771882271369519987366636401731299331",
                "200424492518872412067317923431802673020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2742-65119d17",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/c376b4e8a9991df767172e3fef4dabe059178a68",
        "target":  {
            "file":  "flow-tests/test-frontend/vite-pwa/src/test/java/com/vaadin/viteapp/MainIT.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "49415396267686203516280926310651416414",
            "length":  305
        },
        "id":  "CVE-2026-2742-672eb6b5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/c376b4e8a9991df767172e3fef4dabe059178a68",
        "target":  {
            "file":  "flow-tests/test-frontend/vite-pwa/src/test/java/com/vaadin/viteapp/MainIT.java",
            "function":  "openHomePage_setOffline_vitePingRequestIsRejected"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "225358185459077632478383017355046323877",
                "113176698834404622361944089344504515326",
                "297728531164170018740743098729452781586",
                "211371894869249962533261728780687338335",
                "262755388227073134924503758082904449634",
                "9707424418045582860430213380865025154",
                "115950360186477296653819135223620419038",
                "262893256524994161788378310574433642714",
                "1278803359458009744458905113469176553",
                "31574328065145690095768823924328862267",
                "336023135424789643222437586947305477209",
                "309057302853730536429087106311016481875"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-2742-6dbb864b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/90076b751b26030a271942c3d523b732ced97219",
        "target":  {
            "file":  "flow-test-util/src/main/java/com/vaadin/flow/testutil/DevToolsWrapper.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "237407774042190086475683696069568689878",
            "length":  314
        },
        "id":  "CVE-2026-2742-a4ccd102",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/90076b751b26030a271942c3d523b732ced97219",
        "target":  {
            "file":  "flow-test-util/src/main/java/com/vaadin/flow/testutil/DevToolsWrapper.java",
            "function":  "setOfflineEnabled"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "332236978110757078703998546092871639840",
            "length":  192
        },
        "id":  "CVE-2026-2742-b957ad60",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vaadin/flow/commit/90076b751b26030a271942c3d523b732ced97219",
        "target":  {
            "file":  "flow-test-util/src/main/java/com/vaadin/flow/testutil/DevToolsWrapper.java",
            "function":  "setCacheDisabled"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:28:34Z"