Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-2742Unauthorized session creation via reserved framework path access

Description

An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization. Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

Timeline

  1. ID reserved

    By Vaadin

  2. · 19 days later

    Published

  3. · 6 days later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-2742, by who scored it
Scored byCVSSScoreVector
VaadinCNA (assigner)4.0Medium5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
NVDNVD · Analyzed4.0Medium5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Amber
EPSS (exploitation in 30 days)
0.45% · top 61% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

  • vaadin · vaadin

    • affected 10.0.0 – ≤ 14.14.0
    • affected 15.0.0 – ≤ 23.6.6
    • affected 24.0.0 – ≤ 24.9.7
    • affected 25.0.0 – ≤ 25.0.1

  • vaadin · flow

    • affected 1.0.0 – ≤ 2.13.0
    • affected 3.0.0 – ≤ 23.6.7
    • affected 24.0.0 – ≤ 24.9.7
    • affected 25.0.0 – < 25.0.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

What to do

Solution: Users of affected versions should apply the following mitigation or upgrade.

References

References7

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-2742 badge
[![CVE-2026-2742](https://cveledger.app/badge/CVE-2026-2742.svg)](https://cveledger.app/cve/CVE-2026-2742)

Record last updated .