CVE-2026-2742 Overview
CVE-2026-2742 is an authentication bypass vulnerability affecting Vaadin applications that integrate with Spring Security. The flaw stems from inconsistent path pattern matching of reserved framework paths. Attackers can access the /VAADIN endpoint without a trailing slash to bypass configured security filters. This allows unauthenticated users to trigger framework initialization and create sessions without proper authorization checks [CWE-284].
The vulnerability affects Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7, and 25.0.0 through 25.0.1. Vaadin has issued patched releases across all supported branches.
Critical Impact
Remote unauthenticated attackers can bypass Spring Security filters on Vaadin applications, trigger framework initialization, and create server sessions without authorization.
Affected Products
- Vaadin 14.0.0 through 14.14.0
- Vaadin 23.0.0 through 23.6.6
- Vaadin 24.0.0 through 24.9.7
- Vaadin 25.0.0 through 25.0.1
Discovery Timeline
- 2026-03-10 - CVE-2026-2742 published to NVD
- 2026-05-07 - Last updated in NVD database
Technical Details for CVE-2026-2742
Vulnerability Analysis
The vulnerability resides in how Vaadin applications using Spring Security perform path pattern matching against reserved framework paths. Security filter rules registered for the /VAADIN/** path treat the canonical /VAADIN/ prefix as protected. The matcher does not equivalently handle requests for /VAADIN without a trailing slash.
When a request arrives at /VAADIN, the Spring Security filter chain fails to match the protected pattern. The request passes through unauthenticated, but Vaadin's downstream request handler still processes the path as a framework resource request. This dispatch mismatch is the core of the bypass.
The consequence is that an unauthenticated client can reach Vaadin internals that should require an authenticated session. The framework initializes, allocates a server-side session, and responds as if the caller were authorized to interact with Vaadin endpoints.
Root Cause
The root cause is inconsistent normalization between the Spring Security path matcher and the Vaadin request dispatcher. Spring Security and Vaadin disagree on whether /VAADIN and /VAADIN/ reference the same resource. This category of issue is classified as Improper Access Control [CWE-284].
Attack Vector
The attack is delivered over the network with low complexity and requires no user interaction. An attacker sends an HTTP request to the affected application using /VAADIN as the path, omitting the trailing slash. The request bypasses authentication filters and induces framework initialization. Repeated requests can be used to allocate sessions without credentials, enabling resource consumption and exposing framework behavior to unauthenticated clients.
No verified proof-of-concept code is publicly available at the time of writing. Refer to the Vaadin CVE-2026-2742 Advisory and the upstream fixes in Vaadin Flow Pull Request #22998 and Pull Request #23033 for technical specifics.
Detection Methods for CVE-2026-2742
Indicators of Compromise
- HTTP access log entries containing requests to /VAADIN without a trailing slash, especially from unauthenticated sources.
- Spawning of new Vaadin server sessions correlated with requests that lack authentication cookies or tokens.
- Spikes in /VAADIN request volume from a single source IP, suggesting session-allocation abuse.
Detection Strategies
- Inspect reverse proxy and web server logs for the exact path /VAADIN (no trailing slash) and compare against the authenticated user population.
- Configure Spring Security audit logging to record filter chain decisions and identify requests that bypass authentication on framework paths.
- Add WAF rules that flag or block requests to /VAADIN lacking a trailing slash for monitoring purposes.
Monitoring Recommendations
- Track session creation rate per source IP and alert on anomalies originating from unauthenticated callers.
- Correlate access logs with application session telemetry to identify session allocation without prior login events.
- Forward web server, Spring Security, and application logs to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-2742
Immediate Actions Required
- Upgrade Vaadin to a patched release that matches your current major branch as listed in the patch section below.
- Audit Spring Security configurations for path matchers covering /VAADIN and ensure both trailing-slash and non-trailing-slash variants are protected.
- Restrict network exposure of Vaadin administrative and framework endpoints to trusted networks where feasible.
Patch Information
Vaadin has published fixed versions for each supported branch. Users of Vaadin with Spring Security should upgrade as follows: 14.0.0–14.14.0 to 14.14.1, 23.0.0–23.6.6 to 23.6.7, 24.0.0–24.9.7 to 24.9.8, and 25.0.0–25.0.1 to 25.0.2 or newer. Vaadin versions 10–13 and 15–22 are no longer supported and should be migrated to the latest 14, 23, 24, or 25 release. See the Vaadin Security Advisory and merged pull requests #23034, #23037, #23052, and #23057 for fix details.
Workarounds
- If patching is not immediately possible, add Spring Security matchers that explicitly protect both /VAADIN and /VAADIN/** paths.
- Deploy a reverse proxy or WAF rule that rewrites /VAADIN to /VAADIN/ or denies the non-trailing-slash variant.
- Limit access to the application via network segmentation, VPN, or IP allow-listing until the patch is applied.
# Example: Maven dependency upgrade for Vaadin 24.x
mvn versions:set-property -Dproperty=vaadin.version -DnewVersion=24.9.8
mvn clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
