Cross-Origin Credential Exposure in Vaadin Applications by Vaadin

CVE-2026-110737

What is CVE-2026-110737?

This vulnerability arises in Vaadin applications that employ server push, where the 'Origin' header in requests is reflected in the 'Access-Control-Allow-Origin' response header. Consequently, this misconfiguration allows requests from any origin to access sensitive session data, utilizing user credentials for cross-origin requests. This issue affects applications using the @Push annotation and has persisted since its introduction in January 2015 across all Flow releases and subsequent versions of the Vaadin Framework. Implementing the recommended upgrades helps protect against unauthorized access to user information.

References