EUVD-2026-110721Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated victim to attacker page
-
DeliverySend credentialed cross-origin request to push endpoint
-
ExploitServer reflects Origin and allows credentials
-
ExecutionRead push response (requires session push identifier)
-
ImpactDisclose session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration CORS policy restriction
|
| Exploitation Conditions | Exploitation requires ALL of the following: the target application must use Vaadin server push (@Push) - applications without @Push are explicitly unaffected; the push transport must NOT be WebSocket (the WebSocket transport is explicitly unaffected, so this applies to long-polling/HTTP-based push); an authenticated victim must be tricked into visiting an attacker-controlled page while holding valid session cookies (UI:P); and to read anything useful beyond triggering the request, the attacker must also obtain the session's push identifier. The flaw exists in default push configuration because Flow sets Atmosphere's DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER to false and its CorsInterceptor echoes the request Origin with credentials allowed. The push-identifier requirement and the WebSocket/no-@Push carve-outs are the primary factors limiting real-world risk. |
| Impact | All decision signals point the same direction: this is a low-priority issue, not a high-CVSS-but-overrated one - the official CVSS 4.0 base score is only 2.3 (AV:N/AC:H/AT:N/PR:N/UI:P with VC:L and no integrity/availability impact), and vuln.today's decision label is 'monitor.' There is no EPSS score in the input, no CISA KEV listing, and no public exploit code: the three references are the Vaadin advisory, a GitHub issue, and the fix pull request, so this is 'no public exploit identified at time of analysis' (the PR is the patch, not a weaponized PoC). The CWE-942 CORS misconfiguration is real and long-lived (present since January 2015), but its practical impact is throttled by two independent requirements that the description states explicitly: the victim must be lured to an attacker page (UI:P), and reading anything useful also requires knowledge of the session's push identifier - which is why confidentiality is scored only Low and complexity High. Net: a genuine but minor information-disclosure weakness; patch during normal maintenance rather than as an emergency. |
| Exploit ScenarioDerived | An authenticated user of a Vaadin application that uses @Push (over a non-WebSocket transport) is lured to a malicious web page while logged in; the page issues a cross-origin fetch to the app's push endpoint with the user's cookies, and because the server reflects the request Origin and allows credentials, the attacker page can read the response. To extract meaningful session data the attacker additionally needs that session's push identifier, which limits realistic impact. No public exploit code was identified in the provided references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Cross-origin information disclosure in the Vaadin Flow server-push endpoint allows a page on any origin to make a credentialed request to an authenticated user's push endpoint and read the response, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor echoes the request Origin into Access-Control-Allow-Origin while permitting credentials. Exposure is narrow: only applications using @Push over a non-WebSocket (HTTP/long-polling) transport are affected, and reading anything useful beyond triggering the request also requires the target session's push identifier, which is why CVSS 4.0 scores the issue only 2.3 and the priority decision is 'monitor'. No public exploit code was identified at time of analysis and there is no KEV listing or EPSS score in the available data.
RemediationAI
Vendor-released patches are available for every supported line: upgrade to Vaadin 14.14.8, 23.6.17, 24.4.26, 24.7.17 (covering the 24.5, 24.6 and 24.7 ranges), 24.9.24 (covering 24.8 and 24.9), 24.10.12, 25.2.11 (covering 25.0, 25.1 and 25.2) or 25.3.3; Vaadin Framework users should move to 7.7.55 or 8.32.2. Because the flaw lives in com.vaadin:flow-server, verify the transitive version as well - fixed flow-server builds are 2.13.8, 23.6.16, 24.4.19, 24.7.16, 24.9.29, 24.10.15, 25.1.19, 25.2.13 and 25.3.4 - since upgrading only the vaadin or vaadin-core aggregate may leave an older flow-server resolved. The fix disables Atmosphere's CorsInterceptor, so applications that deliberately embed Flow cross-origin must now configure CORS themselves; plan for that regression when upgrading. Where an immediate upgrade is not possible, note the two scope limits from the advisory: applications not using @Push are unaffected and the WebSocket push transport is unaffected, so pinning push to the WebSocket transport avoids the vulnerable HTTP path at the cost of losing long-polling fallback for clients that cannot use WebSocket. Vaadin 10-13 and 15-22 are unsupported and must be migrated to a current line. Details: https://vaadin.com/security/cve-2026-110737.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vaadin Flow implements server push on top of the Atmosphere framework. PushRequestHandler initializes Atmosphere, and in the vulnerable configuration it passed "false" for DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, which left Atmosphere's CorsInterceptor active; that interceptor reflects whatever Origin header an incoming request carries into Access-Control-Allow-Origin and allows credentials. The result is CWE-942 (Permissive Cross-domain Policy with Untrusted Domains), scoped to the push endpoint rather than the whole application. The flaw was introduced in January 2015 when push was added (Vaadin Framework 7.1.0) and is present in every Flow release up to the fixed builds. The upstream fix in vaadin/flow PR #26215 simply flips that init parameter from "false" to "true", neutralizing Atmosphere's CorsInterceptor so that applications which intentionally embed Flow cross-origin must handle CORS themselves. Two carve-outs bound the issue technically: applications that do not use @Push never expose the endpoint, and the WebSocket push transport is explicitly not affected, so only the HTTP-based push transport (long-polling) participates in the flaw. The CVSS 4.0 vector AV:N/AC:H/PR:N/UI:P/VC:L with no integrity or availability impact, and the independent assessment's CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, both describe a limited-confidentiality, victim-interaction-dependent issue rather than a session takeover.
Know when Vaadin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Remote cross-origin attack (AV:N) but requires victim interaction (UI:R) and knowledge of the session push identifier (AC:H); only limited confidentiality impact (C:L) with no integrity or availability effect.
Primary rating from Vendor (Vaadin).
CVSS VectorVendor: Vaadin
Lifecycle Timeline
1DescriptionCVE.org
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.
Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:
Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1
Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2
Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.
Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:flow-server / 2.13.0 - 2.13.7 / >=2.13.8 com.vaadin:flow-server / 23.6.0 - 23.6.15 / >=23.6.16 com.vaadin:flow-server / 24.4.0 - 24.4.18 / >=24.4.19 com.vaadin:flow-server / 24.5.0 - 24.5.17 / >=24.7.17 com.vaadin:flow-server / 24.6.0 - 24.6.14 / >=24.7.17 com.vaadin:flow-server / 24.7.0 - 24.7.15 / >=24.7.16 com.vaadin:flow-server / 24.8.0 - 24.8.16 / >=24.9.24 com.vaadin:flow-server / 24.9.0 - 24.9.28 / >=24.9.29 com.vaadin:flow-server / 24.10.0 - 24.10.14 / >=24.10.15 com.vaadin:flow-server / 25.0.0 - 25.0.15 / >=25.2.11 com.vaadin:flow-server / 25.1.0 - 25.1.18 / >=25.1.19 com.vaadin:flow-server / 25.2.0 - 25.2.12 / >=25.2.13 com.vaadin:flow-server / 25.3.0 - 25.3.3 / >=25.3.4 com.vaadin:vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaad
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communica
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.1
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9),
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadi
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write a
Exploit-DB