CVE-2026-2742: 
Java vulnerability analysis and mitigation

CVE-2026-2742 is an authentication bypass vulnerability in Vaadin applications that integrate with Spring Security, caused by inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses Spring Security filters, allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization. Affected versions include Vaadin 14.0.0–14.14.0, 23.0.0–23.6.6, 24.0.0–24.9.7, and 25.0.0–25.0.1. The vulnerability was published on March 10, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Vaadin Advisory, Feedly).

The root cause is classified as CWE-284 (Improper Access Control), arising from a discrepancy in how Spring Security's path pattern matching handles the /VAADIN path versus /VAADIN/ (with trailing slash). When a request is made to /VAADIN without a trailing slash, the Spring Security filter chain does not match the reserved framework path pattern, causing security filters to be skipped entirely. The fix, implemented in the Vaadin Flow framework, prevents the IndexHtmlRequestHandler and BootstrapHandler from processing requests to reserved Vaadin folders and returns a 404 response instead (GitHub PR #22998, GitHub PR #23057). This vulnerability only affects applications using Spring Security; other security configurations are not impacted (Vaadin Advisory).

Successful exploitation allows unauthenticated remote attackers to access the /VAADIN endpoint, trigger Vaadin framework initialization, and create unauthorized server-side sessions. The primary impact is a low-severity integrity concern (CVSS integrity impact: Low), as attackers can interact with framework internals without authentication. There is no direct confidentiality impact (no data exposure) or availability impact under the CVSS v3.1 scoring, though unauthorized session creation could contribute to resource exhaustion or serve as a foothold for further application-layer abuse (Feedly, Vaadin Advisory).

1. Reconnaissance: Identify internet-facing Vaadin applications using Spring Security by scanning for Vaadin-specific response headers, JavaScript bundles, or UI patterns using tools like Shodan, Censys, or Burp Suite.
2. Confirm vulnerability: Send an HTTP GET request to the target application's /VAADIN path (without a trailing slash) and observe whether the server responds with framework content or session-related behavior rather than a 401/403 redirect, indicating the security filter was bypassed.
3. Trigger framework initialization: Issue crafted HTTP requests to /VAADIN (no trailing slash) to cause the server to execute Vaadin framework initialization logic without authentication.
4. Session creation: Observe or capture the session cookie returned by the server, confirming that an unauthorized session has been established without proper authentication checks.
5. Further abuse: Use the unauthorized session as a basis for additional application-layer probing, such as attempting to access protected Vaadin views or API endpoints that may trust the existence of a valid session (Vaadin Advisory, GitHub PR #22998).

• Network: Unusual HTTP GET or POST requests to /VAADIN (without trailing slash) from unauthenticated sources; repeated requests to this endpoint from the same IP without prior authentication flows.
• Logs: Web server or application access logs showing requests to /VAADIN (no trailing slash) that result in HTTP 200 responses rather than 401/403; session creation events in application logs not preceded by authentication events.
• Application: Unexpected Vaadin session objects created in the session store without corresponding authenticated user records; framework initialization log entries triggered by unauthenticated requests.

Vaadin has released patched versions addressing this vulnerability: upgrade to 14.14.1 (from 14.0.0–14.14.0), 23.6.7 (from 23.0.0–23.6.6), 24.9.8 (from 24.0.0–24.9.7), or 25.0.2 (from 25.0.0–25.0.1). Vaadin versions 10–13 and 15–22 are end-of-life and unsupported; users on those versions must migrate to a supported branch. As a temporary workaround where immediate patching is not feasible, implement network-level access controls (e.g., WAF rules or reverse proxy configuration) to restrict or monitor access to the /VAADIN endpoint (Vaadin Advisory, GitHub PR #22998).

Vaadin assigned this CVE and published the official security advisory with patch guidance (Vaadin Advisory). The vulnerability was noted in automated CVE tracking feeds and the EU Vulnerability Database (EUVD-2026-10499), but has not attracted significant public researcher commentary or media coverage, consistent with its medium severity rating and lack of known exploitation (Feedly).