{"action":"Upgrade com.vaadin:flow-server to 14.14.1 (14.x), 23.6.7 (23.x), 24.9.8 (24.x) or 25.0.2 (25.x) or later.","affected":[{"fixed":"14.14.1","introduced":"0"},{"fixed":"23.6.7","introduced":"23.0.0"},{"fixed":"24.9.8","introduced":"24.0.0"},{"fixed":"25.0.2","introduced":"25.0.0"}],"component":"com.vaadin:flow-server","cve_ids":["CVE-2026-2742"],"ecosystem":"Maven","epss":0.00407,"exploited":false,"fixed_versions":["14.14.1","23.6.7","24.9.8","25.0.2"],"ghsa_id":"GHSA-rjgh-wgc7-m37j","id":"tcs_01M5N9BZ9K3KJHAM29CSNDT76V","modified_at":"2026-09-10T03:50:41.180797417Z","published_at":"2026-03-10T18:31:21Z","references":["https://osv.dev/vulnerability/GHSA-rjgh-wgc7-m37j","https://nvd.nist.gov/vuln/detail/CVE-2026-2742","https://github.com/vaadin/flow/pull/22998","https://github.com/vaadin/flow/pull/23033","https://github.com/vaadin/flow/pull/23034","https://github.com/vaadin/flow/pull/23037","https://github.com/vaadin/flow/pull/23052","https://github.com/vaadin/flow/pull/23057","https://github.com/vaadin/flow","https://vaadin.com/security/cve-2026-2742"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-rjgh-wgc7-m37j","url":"https://osv.dev/vulnerability/GHSA-rjgh-wgc7-m37j"},{"source":"nvd","source_id":"CVE-2026-2742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2742"}],"summary":"Vaadin Vulnerable to Authentication Bypass When Accessing the /VAADIN Endpoint Without a Trailing Slash"}