CVE-2026-110737: Vaadin server push CORS header injection

CVE-2026-110737 · Severity: info · Published 2026-10-27

Vaadin's server push feature reflects the Origin header from user requests directly into CORS response headers, allowing attackers on any website to make authenticated requests to a Vaadin application's push endpoint and potentially read responses. An attacker would need to know the session's push identifier and trick a logged-in user into visiting a malicious website to exploit this vulnerability.

Technologies: Vaadin. Vendors: Vaadin.

Quick answers

Is CVE-2026-110737 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110737 being exploited in the wild.
How severe is CVE-2026-110737?
Informational severity, published 27 October 2026.
Which products and versions are affected?
Vaadin Flow Server 2.13.0-2.13.7, 23.6.0-23.6.15, 24.4.0-24.4.18, 24.5.0-24.5.17, 24.6.0-24.6.14, 24.7.0-24.7.15, 24.8.0-24.8.16, 24.9.0-24.9.28, 24.10.0-24.10.14, 25.0.0-25.0.15, 25.1.0-25.1.18, 25.2.0-25.2.12, 25.3.0-25.3.3; Vaadin Framework 7.1.0-7.7.54, 8.0.0-8.32.1; Vaadin 14.14.0-14.14.7, 23.6.0-23.6.16, 24.4.0-24.4.25, 24.5.0-24.5.15, 24.6.0-24.6.13, 24.7.0-24.7.16, 24.8.0-24.8.17, 24.9.0-24.9.23, 24.10.0-24.10.11, 25.0.0-25.0.13, 25.1.0-25.1.13, 25.2.0-25.2.10, 25.3.0-25.3.2.
Is there a fix for CVE-2026-110737?
Yes: fixed in Vaadin 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3; Vaadin Framework 7.7.55, 8.32.2; Flow Server 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110737 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-110737?
Check whether you run Vaadin Flow Server, Vaadin Framework or Vaadin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Vaadin 14.14.8, 23.6.17, 24.4.26, 24.7.17, 24.9.24, 24.10.12, 25.2.11, 25.3.3; Vaadin Framework 7.7.55, 8.32.2; Flow Server 2.13.8, 23.6.16, 24.4.19, 24.7.17, 24.9.29, 24.10.15, 25.1.19, 25.2.13, 25.3.4

Technical details

The vulnerability exists in Vaadin's CorsInterceptor, which echoes whatever Origin a request carries into the Access-Control-Allow-Origin response header while credentials are allowed (due to Atmosphere being configured with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false). This enables cross-origin requests from any webpage to the push endpoint with the user's credentials. The issue affects only applications using the @Push annotation; the WebSocket transport and applications without push are unaffected.

Affected products

  • Vaadin Vaadin 14.14.0-14.14.7, 23.6.0-23.6.16, 24.4.0-24.4.25, 24.5.0-24.5.15, 24.6.0-24.6.13, 24.7.0-24.7.16, 24.8.0-24.8.17, 24.9.0-24.9.23, 24.10.0-24.10.11, 25.0.0-25.0.13, 25.1.0-25.1.13, 25.2.0-25.2.10, 25.3.0-25.3.2
  • Vaadin Vaadin Framework 7.1.0-7.7.54, 8.0.0-8.32.1
  • Vaadin Flow Server 2.13.0-2.13.7, 23.6.0-23.6.15, 24.4.0-24.4.18, 24.5.0-24.5.17, 24.6.0-24.6.14, 24.7.0-24.7.15, 24.8.0-24.8.16, 24.9.0-24.9.28, 24.10.0-24.10.14, 25.0.0-25.0.15, 25.1.0-25.1.18, 25.2.0-25.2.12, 25.3.0-25.3.3

Timeline

  • 2026-10-27: disclosed: CVE-2026-110737 published
  • 2015-01: other: Vulnerable behavior introduced

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.