Vaadin: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Medium 5.3
  CVE-2026-2742

  Unauthorized session creation via reserved framework path access

  An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. A…

  vaadin vaadin flow com.vaadin:flow-server Maven
  Mar 10, 2026
• Low 2.3
  CVE-2026-2741

  Zip Slip Path Traversal on Node Unpack

  Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatica…

  vaadin vaadin flow com.vaadin:flow-project Maven
  Mar 10, 2026

Revision history

1. 2026-03-10 #1

   Initiale Fassung

References

• Vaadin Vulnerability Report CVE-2026-2741 vom 2026-03-10
  https://vaadin.com/security/cve-2026-2741
• Vaadin Vulnerability Report CVE-2026-2742 vom 2026-03-10
  https://vaadin.com/security/cve-2026-2742
• Red Hat Bugtracker #2446005 vom 2026-03-10
  https://bugzilla.redhat.com/show_bug.cgi?id=2446005