FKIE_CVE-2026-110737

Vulnerability from fkie_nvd - Published: 2026-10-27 11:17 - Updated: 2026-10-27 16:03
Severity
2.3 (Low) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Summary
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1 Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Artifacts under com.vaadin Maven coordinates / Vulnerable versions / Fixed version vaadin / 14.14.0 - 14.14.7 / >=14.14.8 vaadin / 23.6.0 - 23.6.16 / >=23.6.17 vaadin / 24.4.0 - 24.4.25 / >=24.4.26 vaadin / 24.5.0 - 24.5.15 / >=24.7.17 vaadin / 24.6.0 - 24.6.13 / >=24.7.17 vaadin / 24.7.0 - 24.7.16 / >=24.7.17 vaadin / 24.8.0 - 24.8.17 / >=24.9.24 vaadin / 24.9.0 - 24.9.23 / >=24.9.24 vaadin / 24.10.0 - 24.10.11 / >=24.10.12 vaadin / 25.0.0 - 25.0.13 / >=25.2.11 vaadin / 25.1.0 - 25.1.13 / >=25.2.11 vaadin / 25.2.0 - 25.2.10 / >=25.2.11 vaadin / 25.3.0 - 25.3.2 / >=25.3.3 vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 flow-server / 2.13.0 - 2.13.7 / >=2.13.8 flow-server / 23.6.0 - 23.6.15 / >=23.6.16 flow-server / 24.4.0 - 24.4.18 / >=24.4.19 flow-server / 24.5.0 - 24.5.17 / >=24.7.17 flow-server / 24.6.0 - 24.6.14 / >=24.7.17 flow-server / 24.7.0 - 24.7.15 / >=24.7.16 flow-server / 24.8.0 - 24.8.16 / >=24.9.24 flow-server / 24.9.0 - 24.9.28 / >=24.9.29 flow-server / 24.10.0 - 24.10.14 / >=24.10.15 flow-server / 25.0.0 - 25.0.15 / >=25.2.11 flow-server / 25.1.0 - 25.1.18 / >=25.1.19 flow-server / 25.2.0 - 25.2.12 / >=25.2.13 flow-server / 25.3.0 - 25.3.3 / >=25.3.4 vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
References
security@vaadin.comhttps://github.com/vaadin/flow/issues/26214
security@vaadin.comhttps://github.com/vaadin/flow/pull/26215
security@vaadin.comhttps://vaadin.com/security/cve-2026-110737
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin",
          "product": "vaadin",
          "repo": "https://github.com/vaadin/platform",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "14.14.8",
              "status": "affected",
              "version": "14.14.0",
              "versionType": "maven"
            },
            {
              "lessThan": "23.6.17",
              "status": "affected",
              "version": "23.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.4.26",
              "status": "affected",
              "version": "24.4.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.5.15",
              "status": "affected",
              "version": "24.5.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.6.13",
              "status": "affected",
              "version": "24.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.7.17",
              "status": "affected",
              "version": "24.7.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.8.17",
              "status": "affected",
              "version": "24.8.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.9.24",
              "status": "affected",
              "version": "24.9.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.10.12",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "25.0.13",
              "status": "affected",
              "version": "25.0.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "25.1.13",
              "status": "affected",
              "version": "25.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.2.11",
              "status": "affected",
              "version": "25.2.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.3.3",
              "status": "affected",
              "version": "25.3.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin-core",
          "product": "vaadin",
          "repo": "https://github.com/vaadin/platform",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "14.14.8",
              "status": "affected",
              "version": "14.14.0",
              "versionType": "maven"
            },
            {
              "lessThan": "23.6.17",
              "status": "affected",
              "version": "23.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.4.26",
              "status": "affected",
              "version": "24.4.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.5.15",
              "status": "affected",
              "version": "24.5.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.6.13",
              "status": "affected",
              "version": "24.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.7.17",
              "status": "affected",
              "version": "24.7.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.8.17",
              "status": "affected",
              "version": "24.8.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.9.24",
              "status": "affected",
              "version": "24.9.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.10.12",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "25.0.13",
              "status": "affected",
              "version": "25.0.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "25.1.13",
              "status": "affected",
              "version": "25.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.2.11",
              "status": "affected",
              "version": "25.2.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.3.3",
              "status": "affected",
              "version": "25.3.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:flow-server",
          "product": "flow",
          "repo": "https://github.com/vaadin/flow",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "2.13.8",
              "status": "affected",
              "version": "2.13.0",
              "versionType": "maven"
            },
            {
              "lessThan": "23.6.16",
              "status": "affected",
              "version": "23.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.4.19",
              "status": "affected",
              "version": "24.4.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.5.17",
              "status": "affected",
              "version": "24.5.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.6.14",
              "status": "affected",
              "version": "24.6.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.7.16",
              "status": "affected",
              "version": "24.7.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "24.8.16",
              "status": "affected",
              "version": "24.8.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.9.29",
              "status": "affected",
              "version": "24.9.0",
              "versionType": "maven"
            },
            {
              "lessThan": "24.10.15",
              "status": "affected",
              "version": "24.10.0",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "25.0.15",
              "status": "affected",
              "version": "25.0.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.1.19",
              "status": "affected",
              "version": "25.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.2.13",
              "status": "affected",
              "version": "25.2.0",
              "versionType": "maven"
            },
            {
              "lessThan": "25.3.4",
              "status": "affected",
              "version": "25.3.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin-server",
          "product": "framework",
          "repo": "https://github.com/vaadin/framework",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "7.7.55",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "maven"
            },
            {
              "lessThan": "8.32.2",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin-server-mpr-jakarta",
          "product": "framework",
          "repo": "https://github.com/vaadin/framework",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "7.7.55",
              "status": "affected",
              "version": "7.7.36",
              "versionType": "maven"
            },
            {
              "lessThan": "8.32.2",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "security@vaadin.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user\u0027s cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin 14.14.0 - 14.14.7\nVaadin 23.6.0 - 23.6.16\nVaadin 24.4.0 - 24.4.25\nVaadin 24.5.0 - 24.5.15\nVaadin 24.6.0 - 24.6.13\nVaadin 24.7.0 - 24.7.16\nVaadin 24.8.0 - 24.8.17\nVaadin 24.9.0 - 24.9.23\nVaadin 24.10.0 - 24.10.11\nVaadin 25.0.0 - 25.0.13\nVaadin 25.1.0 - 25.1.13\nVaadin 25.2.0 - 25.2.10\nVaadin 25.3.0 - 25.3.2\nVaadin Framework 7.1.0 - 7.7.54\nVaadin Framework 8.0.0 - 8.32.1\n\nMitigation\nUpgrade to 14.14.8\nUpgrade to 23.6.17\nUpgrade to 24.4.26\nUpgrade to 24.7.17\nUpgrade to 24.7.17\nUpgrade to 24.7.17\nUpgrade to 24.9.24\nUpgrade to 24.9.24\nUpgrade to 24.10.12\nUpgrade to 25.2.11\nUpgrade to 25.2.11\nUpgrade to 25.2.11\nUpgrade to 25.3.3\nUpgrade to 7.7.55\nUpgrade to 8.32.2\n\nPlease note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.\n\nArtifacts under com.vaadin\nMaven coordinates / Vulnerable versions / Fixed version\nvaadin / 14.14.0 - 14.14.7 / \u003e=14.14.8\nvaadin / 23.6.0 - 23.6.16 / \u003e=23.6.17\nvaadin / 24.4.0 - 24.4.25 / \u003e=24.4.26\nvaadin / 24.5.0 - 24.5.15 / \u003e=24.7.17\nvaadin / 24.6.0 - 24.6.13 / \u003e=24.7.17\nvaadin / 24.7.0 - 24.7.16 / \u003e=24.7.17\nvaadin / 24.8.0 - 24.8.17 / \u003e=24.9.24\nvaadin / 24.9.0 - 24.9.23 / \u003e=24.9.24\nvaadin / 24.10.0 - 24.10.11 / \u003e=24.10.12\nvaadin / 25.0.0 - 25.0.13 / \u003e=25.2.11\nvaadin / 25.1.0 - 25.1.13 / \u003e=25.2.11\nvaadin / 25.2.0 - 25.2.10 / \u003e=25.2.11\nvaadin / 25.3.0 - 25.3.2 / \u003e=25.3.3\nvaadin-core / 14.14.0 - 14.14.7 / \u003e=14.14.8\nvaadin-core / 23.6.0 - 23.6.16 / \u003e=23.6.17\nvaadin-core / 24.4.0 - 24.4.25 / \u003e=24.4.26\nvaadin-core / 24.5.0 - 24.5.15 / \u003e=24.7.17\nvaadin-core / 24.6.0 - 24.6.13 / \u003e=24.7.17\nvaadin-core / 24.7.0 - 24.7.16 / \u003e=24.7.17\nvaadin-core / 24.8.0 - 24.8.17 / \u003e=24.9.24\nvaadin-core / 24.9.0 - 24.9.23 / \u003e=24.9.24\nvaadin-core / 24.10.0 - 24.10.11 / \u003e=24.10.12\nvaadin-core / 25.0.0 - 25.0.13 / \u003e=25.2.11\nvaadin-core / 25.1.0 - 25.1.13 / \u003e=25.2.11\nvaadin-core / 25.2.0 - 25.2.10 / \u003e=25.2.11\nvaadin-core / 25.3.0 - 25.3.2 / \u003e=25.3.3\nflow-server / 2.13.0 - 2.13.7 / \u003e=2.13.8\nflow-server / 23.6.0 - 23.6.15 / \u003e=23.6.16\nflow-server / 24.4.0 - 24.4.18 / \u003e=24.4.19\nflow-server / 24.5.0 - 24.5.17 / \u003e=24.7.17\nflow-server / 24.6.0 - 24.6.14 / \u003e=24.7.17\nflow-server / 24.7.0 - 24.7.15 / \u003e=24.7.16\nflow-server / 24.8.0 - 24.8.16 / \u003e=24.9.24\nflow-server / 24.9.0 - 24.9.28 / \u003e=24.9.29\nflow-server / 24.10.0 - 24.10.14 / \u003e=24.10.15\nflow-server / 25.0.0 - 25.0.15 / \u003e=25.2.11\nflow-server / 25.1.0 - 25.1.18 / \u003e=25.1.19\nflow-server / 25.2.0 - 25.2.12 / \u003e=25.2.13\nflow-server / 25.3.0 - 25.3.3 / \u003e=25.3.4\nvaadin-server / 7.1.0 - 7.7.54 / \u003e=7.7.55\nvaadin-server / 8.0.0 - 8.32.1 / \u003e=8.32.2\nvaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / \u003e=7.7.55\nvaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / \u003e=8.32.2"
    }
  ],
  "id": "CVE-2026-110737",
  "lastModified": "2026-10-27T16:03:45.247",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security@vaadin.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-27T11:17:27.020",
  "references": [
    {
      "source": "security@vaadin.com",
      "url": "https://github.com/vaadin/flow/issues/26214"
    },
    {
      "source": "security@vaadin.com",
      "url": "https://github.com/vaadin/flow/pull/26215"
    },
    {
      "source": "security@vaadin.com",
      "url": "https://vaadin.com/security/cve-2026-110737"
    }
  ],
  "sourceIdentifier": "security@vaadin.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        },
        {
          "lang": "en",
          "value": "CWE-942"
        }
      ],
      "source": "security@vaadin.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.