{"id":"GHSA-rjgh-wgc7-m37j","summary":"Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash","details":"An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.\n\nAccessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.\n\nUsers of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and users should update either to the latest 14, 23, 24, 25 version.","aliases":["CVE-2026-2742"],"modified":"2026-09-10T03:50:41.180797417Z","published":"2026-03-10T18:31:21Z","database_specific":{"nvd_published_at":"2026-03-10T18:18:49Z","cwe_ids":["CWE-284"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-03-11T19:00:34Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2742"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/22998"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/23033"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/23034"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/23037"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/23052"},{"type":"WEB","url":"https://github.com/vaadin/flow/pull/23057"},{"type":"PACKAGE","url":"https://github.com/vaadin/flow"},{"type":"WEB","url":"https://vaadin.com/security/cve-2026-2742"}],"affected":[{"package":{"name":"com.vaadin:flow-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.14.1"}]}],"versions":["1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.2","1.0.20","1.0.21","1.0.22","1.0.23","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.3.0","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.19","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0.beta2","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.6","2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.12.0","2.12.1","2.12.2","2.12.3","2.13.0","2.13.0-beta1","2.13.1","2.13.2","2.13.3","2.13.4","2.13.5","2.13.6","2.13.7","2.2.0","2.2.0.alpha11","2.2.1","2.2.2","2.2.3","2.3.0","2.3.0.beta1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.19","2.7.2","2.7.20","2.7.21","2.7.22","2.7.23","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.11","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.10","2.9.11","2.9.12","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.1.0","3.1.1","3.1.2","3.1.3","3.1.5","3.1.6","3.1.7","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","6.0.0","6.0.1","6.0.10","6.0.2","6.0.3","6.0.4","6.0.5","6.0.6","6.0.7","6.0.8","6.0.9","7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5","7.0.6","7.0.7","7.0.8","7.0.9","8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.15","9.0.16","9.0.17","9.0.18","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.23","9.0.24","9.0.25","9.0.26","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.1","9.1.10","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.1","9.2.2","9.2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:flow-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"23.6.7"}]}],"versions":["23.0.0","23.0.1","23.0.10","23.0.11","23.0.12","23.0.13","23.0.14","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8","23.0.9","23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.2","23.1.3","23.1.4","23.1.5","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.4.2","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.2","23.6.3","23.6.4","23.6.5","23.6.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:flow-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.9.8"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.16","24.0.17","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.19","24.1.2","24.1.20","24.1.21","24.1.22","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.22","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.2","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.16","24.5.17","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.14","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.14","24.8.15","24.8.16","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9","24.9.0","24.9.0-beta1","24.9.0-beta2","24.9.0-beta3","24.9.0-rc1","24.9.0-rc2","24.9.1","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6","24.9.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:flow-server","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/flow-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.2"}]}],"versions":["25.0.0","25.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.0.0"},{"fixed":"25.0.2"}]}],"versions":["25.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"24.0.0"},{"fixed":"24.9.8"}]}],"versions":["24.0.0","24.0.1","24.0.10","24.0.11","24.0.12","24.0.13","24.0.14","24.0.15","24.0.2","24.0.3","24.0.4","24.0.5","24.0.6","24.0.7","24.0.8","24.0.9","24.1.0","24.1.1","24.1.10","24.1.11","24.1.12","24.1.13","24.1.14","24.1.15","24.1.16","24.1.17","24.1.18","24.1.2","24.1.3","24.1.4","24.1.5","24.1.6","24.1.7","24.1.8","24.1.9","24.2.0","24.2.1","24.2.10","24.2.11","24.2.12","24.2.13","24.2.2","24.2.3","24.2.4","24.2.5","24.2.6","24.2.7","24.2.8","24.2.9","24.3.0","24.3.1","24.3.10","24.3.11","24.3.12","24.3.13","24.3.14","24.3.15","24.3.16","24.3.17","24.3.18","24.3.19","24.3.2","24.3.20","24.3.21","24.3.3","24.3.4","24.3.5","24.3.6","24.3.7","24.3.8","24.3.9","24.4.0","24.4.1","24.4.10","24.4.11","24.4.12","24.4.13","24.4.14","24.4.15","24.4.16","24.4.17","24.4.18","24.4.19","24.4.2","24.4.20","24.4.21","24.4.22","24.4.23","24.4.3","24.4.4","24.4.5","24.4.6","24.4.7","24.4.8","24.4.9","24.5.0","24.5.1","24.5.10","24.5.11","24.5.12","24.5.13","24.5.14","24.5.15","24.5.2","24.5.3","24.5.4","24.5.5","24.5.6","24.5.7","24.5.8","24.5.9","24.6.0","24.6.1","24.6.10","24.6.11","24.6.12","24.6.13","24.6.2","24.6.3","24.6.4","24.6.5","24.6.6","24.6.7","24.6.8","24.6.9","24.7.0","24.7.1","24.7.10","24.7.11","24.7.12","24.7.13","24.7.14","24.7.15","24.7.2","24.7.3","24.7.4","24.7.5","24.7.6","24.7.7","24.7.8","24.7.9","24.8.0","24.8.1","24.8.10","24.8.11","24.8.12","24.8.13","24.8.14","24.8.15","24.8.16","24.8.17","24.8.2","24.8.3","24.8.4","24.8.5","24.8.6","24.8.7","24.8.8","24.8.9","24.9.0","24.9.0-beta1","24.9.0-beta2","24.9.0-beta3","24.9.0-rc1","24.9.0-rc2","24.9.1","24.9.2","24.9.3","24.9.4","24.9.5","24.9.6","24.9.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0.0"},{"fixed":"23.6.7"}]}],"versions":["23.0.0","23.0.1","23.0.10","23.0.11","23.0.12","23.0.13","23.0.14","23.0.15","23.0.16","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","23.0.8","23.0.9","23.1.0","23.1.1","23.1.10","23.1.11","23.1.12","23.1.13","23.1.14","23.1.15","23.1.16","23.1.17","23.1.2","23.1.3","23.1.4","23.1.6","23.1.7","23.1.8","23.1.9","23.2.0","23.2.1","23.2.10","23.2.11","23.2.12","23.2.13","23.2.14","23.2.15","23.2.16","23.2.17","23.2.2","23.2.3","23.2.4","23.2.5","23.2.6","23.2.7","23.2.8","23.2.9","23.3.0","23.3.1","23.3.10","23.3.11","23.3.12","23.3.13","23.3.14","23.3.15","23.3.16","23.3.17","23.3.18","23.3.19","23.3.2","23.3.20","23.3.21","23.3.22","23.3.23","23.3.24","23.3.25","23.3.26","23.3.27","23.3.28","23.3.29","23.3.3","23.3.30","23.3.31","23.3.32","23.3.33","23.3.34","23.3.35","23.3.4","23.3.5","23.3.6","23.3.7","23.3.8","23.3.9","23.4.0","23.4.1","23.4.2","23.5.0","23.5.1","23.5.10","23.5.11","23.5.12","23.5.13","23.5.14","23.5.15","23.5.16","23.5.17","23.5.18","23.5.2","23.5.3","23.5.4","23.5.5","23.5.6","23.5.7","23.5.8","23.5.9","23.6.0","23.6.1","23.6.2","23.6.3","23.6.4","23.6.5","23.6.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}},{"package":{"name":"com.vaadin:vaadin","ecosystem":"Maven","purl":"pkg:maven/com.vaadin/vaadin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.14.1"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","11.0.1","11.0.2","11.0.3","11.0.4","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","13.0.0","13.0.1","13.0.10","13.0.11","13.0.12","13.0.13","13.0.2","13.0.3","13.0.4","13.0.5","13.0.6","13.0.7","13.0.8","13.0.9","14.0.0","14.0.1","14.0.10","14.0.11","14.0.12","14.0.13","14.0.14","14.0.15","14.0.2","14.0.3","14.0.4","14.0.5","14.0.6","14.0.7","14.0.8","14.0.9","14.1.0","14.1.1","14.1.16","14.1.17","14.1.18","14.1.19","14.1.2","14.1.20","14.1.21","14.1.22","14.1.23","14.1.24","14.1.25","14.1.26","14.1.27","14.1.28","14.1.3","14.1.4","14.1.5","14.10.0","14.10.1","14.10.10","14.10.11","14.10.12","14.10.2","14.10.3","14.10.4","14.10.5","14.10.6","14.10.7","14.10.8","14.10.9","14.11.0","14.11.1","14.11.10","14.11.11","14.11.12","14.11.13","14.11.14","14.11.2","14.11.3","14.11.4","14.11.5","14.11.6","14.11.7","14.11.8","14.11.9","14.12.0","14.12.1","14.12.2","14.12.3","14.12.4","14.12.5","14.12.6","14.12.7","14.12.8","14.13.0","14.13.1","14.13.2","14.14.0","14.14.0-beta1","14.2.0","14.2.1","14.2.2","14.2.3","14.3.0","14.3.1","14.3.2","14.3.3","14.3.4","14.3.5","14.3.6","14.3.7","14.3.8","14.3.9","14.4.0","14.4.1","14.4.10","14.4.2","14.4.3","14.4.4","14.4.5","14.4.6","14.4.7","14.4.8","14.4.9","14.5.0","14.5.1","14.5.2","14.5.3","14.5.4","14.5.5","14.6.0","14.6.1","14.6.2","14.6.3","14.6.4","14.6.5","14.6.6","14.6.7","14.6.8","14.6.9","14.7.0","14.7.1","14.7.2","14.7.3","14.7.4","14.7.5","14.7.6","14.7.7","14.7.8","14.8.0","14.8.1","14.8.10","14.8.11","14.8.12","14.8.13","14.8.14","14.8.15","14.8.16","14.8.17","14.8.18","14.8.19","14.8.2","14.8.20","14.8.3","14.8.4","14.8.5","14.8.6","14.8.7","14.8.8","14.8.9","14.9.0","14.9.1","14.9.2","14.9.3","14.9.4","14.9.5","14.9.6","14.9.7","14.9.8","6.0.0","6.0.1","6.1.0","6.1.1","6.1.2","6.1.3","6.1.4","6.1.5","6.2.0","6.2.0.pre1","6.2.1","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.3.0","6.3.0.pre1","6.3.1","6.3.2","6.3.3","6.3.4","6.4.0","6.4.0.pre1","6.4.1","6.4.10","6.4.2","6.4.3","6.4.4","6.4.5","6.4.6","6.4.7","6.4.8","6.4.9","6.5.0","6.5.0.pre1","6.5.0.pre2","6.5.1","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.6.0","6.6.0.pre1","6.6.1","6.6.2","6.6.3","6.6.4","6.6.5","6.6.6","6.6.7","6.6.8","6.7.0","6.7.0.beta1","6.7.0.rc1","6.7.1","6.7.10","6.7.2","6.7.3","6.7.4","6.7.5","6.7.6","6.7.7","6.7.8","6.7.9","6.8.0","6.8.0.rc1","6.8.1","6.8.10","6.8.11","6.8.12","6.8.13","6.8.14","6.8.15","6.8.16","6.8.17","6.8.18","6.8.2","6.8.3","6.8.4","6.8.5","6.8.6","6.8.7","6.8.8","6.8.9","7.0.0.alpha1","7.0.0.alpha2","7.0.0.alpha3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-rjgh-wgc7-m37j/GHSA-rjgh-wgc7-m37j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber"}]}