CVE-2026-2742: Vaadin Authentication Bypass Vulnerability

CVE-2026-2742 Overview

An authentication bypass vulnerability exists in the Vaadin web application framework when used with Spring Security. The flaw stems from inconsistent path pattern matching of reserved framework paths, specifically affecting how the /VAADIN endpoint handles requests without a trailing slash. This inconsistency allows unauthenticated users to bypass security filters, trigger framework initialization, and create sessions without proper authorization.

The vulnerability affects multiple Vaadin release branches including versions 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7, and 25.0.0 through 25.0.1. Organizations running Vaadin applications with Spring Security integration should prioritize upgrading to patched versions.

Critical Impact

Unauthenticated attackers can bypass Spring Security filters by accessing the /VAADIN endpoint without a trailing slash, enabling unauthorized session creation and framework initialization in affected applications.

Affected Products

• Vaadin 14.0.0 through 14.14.0
• Vaadin 23.0.0 through 23.6.6
• Vaadin 24.0.0 through 24.9.7
• Vaadin 25.0.0 through 25.0.1

Discovery Timeline

• 2026-03-10 - CVE-2026-2742 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-2742

Vulnerability Analysis

This authentication bypass vulnerability (CWE-284: Improper Access Control) occurs due to a mismatch between how Vaadin's internal routing handles the /VAADIN endpoint and how Spring Security interprets path patterns. When Spring Security is configured to protect application routes, the security filter chain relies on consistent path matching to enforce authentication requirements.

The /VAADIN endpoint is a reserved framework path used by Vaadin for serving static resources, client-side engine files, and handling internal framework operations. Under normal circumstances, this endpoint should be subject to the same security constraints as other application paths when Spring Security is enabled.

The vulnerability allows attackers to access the endpoint by omitting the trailing slash, which causes the request to bypass Spring Security's path matching logic while still being processed by Vaadin's internal handlers. This creates an opportunity for unauthorized framework initialization and session creation, potentially serving as a stepping stone for further exploitation.

Root Cause

The root cause lies in inconsistent path pattern matching between Vaadin's internal request routing and Spring Security's filter chain. Vaadin treats /VAADIN and /VAADIN/ as equivalent endpoints for framework operations, while Spring Security's path matchers may only be configured to protect one variant. This semantic gap allows requests to slip through security enforcement when formatted in a way that Spring Security does not recognize as a protected path but Vaadin still processes.

Attack Vector

An attacker can exploit this vulnerability by sending HTTP requests directly to the /VAADIN endpoint without a trailing slash. Since this is a network-accessible attack vector requiring low complexity and no special privileges, attackers can craft simple HTTP requests to trigger the bypass. The attack does not require user interaction, making it suitable for automated exploitation attempts.

The exploitation flow involves:

1. Identifying a Vaadin application using Spring Security
2. Sending a request to /VAADIN (without trailing slash)
3. Bypassing Spring Security authentication filters
4. Triggering unauthorized framework initialization
5. Creating sessions without proper authorization

For technical implementation details, refer to the Vaadin CVE-2026-2742 Advisory and associated pull requests including PR #22998, PR #23033, and PR #23034.

Detection Methods for CVE-2026-2742

Indicators of Compromise

• Unexpected HTTP requests to /VAADIN endpoint without trailing slash from external IP addresses
• Anomalous session creation events not associated with authenticated user activity
• Framework initialization logs triggered by requests lacking proper authentication context
• Increased volume of requests to framework-reserved paths from untrusted sources

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and log requests to /VAADIN endpoints with unusual path patterns
• Review Spring Security logs for authentication bypass attempts and unexpected anonymous session creation
• Deploy SentinelOne Singularity to detect behavioral anomalies associated with unauthorized application access
• Analyze HTTP access logs for patterns indicating path manipulation attempts targeting Vaadin framework endpoints

Monitoring Recommendations

• Configure alerting for requests to /VAADIN without trailing slash from external networks
• Monitor session creation rates for anomalies that may indicate unauthorized access
• Implement application-level logging for all framework initialization events with correlation to authentication state
• Enable SentinelOne's real-time threat detection to identify exploitation attempts targeting web application vulnerabilities

How to Mitigate CVE-2026-2742

Immediate Actions Required

• Identify all Vaadin applications in your environment and determine their version numbers
• Prioritize upgrading applications using Spring Security to patched Vaadin versions
• Review application logs for evidence of exploitation attempts prior to patching
• Implement temporary WAF rules to normalize path patterns for /VAADIN requests while preparing upgrades

Patch Information

Vaadin has released patches across all affected version branches. Users should upgrade according to their current version:

Note that Vaadin versions 10-13 and 15-22 are no longer supported. Users on these versions should migrate to the latest supported release branch (14, 23, 24, or 25).

For patch implementation details, review the fix commits in PR #23037, PR #23052, and PR #23057.

Workarounds

• Configure Spring Security with explicit path matchers that cover both /VAADIN and /VAADIN/** patterns
• Implement a servlet filter or reverse proxy rule to normalize /VAADIN requests by appending trailing slashes before reaching the application
• Restrict access to /VAADIN endpoints at the network level using firewall rules while awaiting patched versions
• Consider temporarily disabling public access to affected applications if they handle sensitive operations

# Example Spring Security configuration snippet to cover path variations
# Add explicit antMatchers for Vaadin paths in your SecurityConfiguration
# .antMatchers("/VAADIN", "/VAADIN/**").permitAll()
# Note: Consult official Vaadin documentation for recommended Spring Security configuration