Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
Vaadin 18-19: Attackers can access Fusion endpoints after logout
published 5 years ago
Summary
Using the logout feature in Vaadin's Authentication module can be bypassed by an attacker on the same network, allowing them to access sensitive pages even after a user thinks they've logged out. This affects Vaadin versions 18 and 19, and can be fixed by upgrading to a patched version of the software. Users should update to a fixed version as soon as possible.
What to do
- Update vaadin com.vaadin:flow-client to version 6.0.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | vaadin | com.vaadin:flow-client |
>= 5.0.0, < 6.0.5 Fix: upgrade to 6.0.5
|
Original advisory text
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.
- https://vaadin.com/security/cve-2021-31408
- https://vaadin.com/security/cve-2021-31408
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published22 Apr 2021
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-6hgr-2g6q-3rmc · GHSA
Track software like this
Free during beta