CVE-2026-2742 Unauthorized session creation via reserved framework path access
Attackers can bypass authentication and create unauthorized sessions by accessing reserved framework paths without a trailing slash in Vaadin applications using Spring Security.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2742?
CVE-2026-2742 is a medium-severity authentication bypass vulnerability in vaadin flow, published on 10 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths.
Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization.
Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer.
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Weakness: CWE-284
Which versions are affected by CVE-2026-2742?
16 open source packages ship an affected version, including com.vaadin:flow-server and com.vaadin:vaadin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:flow-server Maven | All versions | 14.14.1 |
com.vaadin:flow-server Maven | All versions | 14.14.1 |
com.vaadin:flow-server Maven | From 23.0.0 | 23.6.7 |
com.vaadin:flow-server Maven | From 23.0.0 | 23.6.7 |
com.vaadin:flow-server Maven | From 24.0.0 | 24.9.8 |
com.vaadin:flow-server Maven | From 24.0.0 | 24.9.8 |
10 more packages
com.vaadin:flow-server Maven | From 25.0.0 | 25.0.2 |
com.vaadin:flow-server Maven | From 25.0.0 | 25.0.2 |
com.vaadin:vaadin Maven | All versions | 14.14.1 |
com.vaadin:vaadin Maven | All versions | 14.14.1 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.6.7 |
com.vaadin:vaadin Maven | From 23.0.0 | 23.6.7 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.9.8 |
com.vaadin:vaadin Maven | From 24.0.0 | 24.9.8 |
com.vaadin:vaadin Maven | From 25.0.0 | 25.0.2 |
com.vaadin:vaadin Maven | From 25.0.0 | 25.0.2 |
Products include Vaadin Vaadin.
How do I fix CVE-2026-2742?
Upgrade com.vaadin:flow-server to a fixed version for your release line: 14.14.1, 23.6.7, 24.9.8 or 25.0.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-2742 being exploited?
There is no known exploitation of CVE-2026-2742 in the wild and no public exploit code.
Other vulnerabilities in vaadin flow
- CVE-2021-31409 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
- CVE-2020-36320 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7
- CVE-2021-33611 Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
- CVE-2023-25499 Possible information disclosure in non visible components
- CVE-2022-29567 Possible information disclosure inside TreeGrid component with default data provider
Sources
Also known as GHSA-rjgh-wgc7-m37j.