CVE-2026-110737
Received Received - Intake

Origin Reflection in Vaadin Server Push Endpoint

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: Vaadin Ltd.

Description
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1 Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 com.vaadin:vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 com.vaadin:vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 com.vaadin:vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 com.vaadin:vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 com.vaadin:vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 com.vaadin:vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 com.vaadin:vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 com.vaadin:vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 com.vaadin:vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 com.vaadin:vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 com.vaadin:vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 com.vaadin:vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 com.vaadin:flow-server / 2.13.0 - 2.13.7 / >=2.13.8 com.vaadin:flow-server / 23.6.0 - 23.6.15 / >=23.6.16 com.vaadin:flow-server / 24.4.0 - 24.4.18 / >=24.4.19 com.vaadin:flow-server / 24.5.0 - 24.5.17 / >=24.7.17 com.vaadin:flow-server / 24.6.0 - 24.6.14 / >=24.7.17 com.vaadin:flow-server / 24.7.0 - 24.7.15 / >=24.7.16 com.vaadin:flow-server / 24.8.0 - 24.8.16 / >=24.9.24 com.vaadin:flow-server / 24.9.0 - 24.9.28 / >=24.9.29 com.vaadin:flow-server / 24.10.0 - 24.10.14 / >=24.10.15 com.vaadin:flow-server / 25.0.0 - 25.0.15 / >=25.2.11 com.vaadin:flow-server / 25.1.0 - 25.1.18 / >=25.1.19 com.vaadin:flow-server / 25.2.0 - 25.2.12 / >=25.2.13 com.vaadin:flow-server / 25.3.0 - 25.3.3 / >=25.3.4 com.vaadin:vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-110737
EUVD
EUVD-2026-110721

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vaadin applications using server push. The push endpoint incorrectly reflects the request Origin header into the Access-Control-Allow-Origin response header and allows credentials. This enables a malicious site to make cross-origin requests on behalf of a signed-in user and read the response. The issue was introduced in 2015 and exists in multiple Vaadin versions.

Impact Analysis

A malicious website could make cross-origin requests to the vulnerable endpoint using a user's cookies and read the response if they also obtain the push identifier for that session. This could lead to unauthorized data access. Applications without @Push or using WebSocket transport are not affected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart