Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-1yr9-vf3r-3fh6
Vulnerability ID VCID-1yr9-vf3r-3fh6
Aliases CVE-2026-2742
GHSA-rjgh-wgc7-m37j
Summary An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization. Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-284 Improper Access Control
CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2742.json
epss 0.00418 https://api.first.org/data/v1/epss?cve=CVE-2026-2742
epss 0.00418 https://api.first.org/data/v1/epss?cve=CVE-2026-2742
epss 0.00418 https://api.first.org/data/v1/epss?cve=CVE-2026-2742
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-rjgh-wgc7-m37j
cvssv4 5.3 https://github.com/vaadin/flow
generic_textual MODERATE https://github.com/vaadin/flow
cvssv4 5.3 https://github.com/vaadin/flow/pull/22998
generic_textual MODERATE https://github.com/vaadin/flow/pull/22998
ssvc Track https://github.com/vaadin/flow/pull/22998
cvssv4 5.3 https://github.com/vaadin/flow/pull/23033
generic_textual MODERATE https://github.com/vaadin/flow/pull/23033
ssvc Track https://github.com/vaadin/flow/pull/23033
cvssv4 5.3 https://github.com/vaadin/flow/pull/23034
generic_textual MODERATE https://github.com/vaadin/flow/pull/23034
ssvc Track https://github.com/vaadin/flow/pull/23034
cvssv4 5.3 https://github.com/vaadin/flow/pull/23037
generic_textual MODERATE https://github.com/vaadin/flow/pull/23037
ssvc Track https://github.com/vaadin/flow/pull/23037
cvssv4 5.3 https://github.com/vaadin/flow/pull/23052
generic_textual MODERATE https://github.com/vaadin/flow/pull/23052
ssvc Track https://github.com/vaadin/flow/pull/23052
cvssv4 5.3 https://github.com/vaadin/flow/pull/23057
generic_textual MODERATE https://github.com/vaadin/flow/pull/23057
ssvc Track https://github.com/vaadin/flow/pull/23057
cvssv4 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-2742
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-2742
cvssv4 5.3 https://vaadin.com/security/cve-2026-2742
generic_textual MODERATE https://vaadin.com/security/cve-2026-2742
ssvc Track https://vaadin.com/security/cve-2026-2742
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2742.json
https://api.first.org/data/v1/epss?cve=CVE-2026-2742
https://github.com/vaadin/flow
22998 https://github.com/vaadin/flow/pull/22998
23033 https://github.com/vaadin/flow/pull/23033
23034 https://github.com/vaadin/flow/pull/23034
23037 https://github.com/vaadin/flow/pull/23037
23052 https://github.com/vaadin/flow/pull/23052
23057 https://github.com/vaadin/flow/pull/23057
2446005 https://bugzilla.redhat.com/show_bug.cgi?id=2446005
cve-2026-2742 https://vaadin.com/security/cve-2026-2742
CVE-2026-2742 https://nvd.nist.gov/vuln/detail/CVE-2026-2742
GHSA-rjgh-wgc7-m37j https://github.com/advisories/GHSA-rjgh-wgc7-m37j
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-2742.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/22998
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/22998
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/23033
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/23033
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/23034
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/23034
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/23037
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/23037
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/23052
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/23052
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://github.com/vaadin/flow/pull/23057
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://github.com/vaadin/flow/pull/23057
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://nvd.nist.gov/vuln/detail/CVE-2026-2742
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber Found at https://vaadin.com/security/cve-2026-2742
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-03-10T13:42:57Z/ Found at https://vaadin.com/security/cve-2026-2742
Exploit Prediction Scoring System (EPSS)
Percentile 0.62284
EPSS Score 0.00418
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:54:07.950421+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/2xxx/CVE-2026-2742.json 38.6.0