What’s Vulnerable › Vulnerabilities

CVE-2021-31409: Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-06 · updated 2026-06-17
• Weakness: CWE-400

Description

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Affected products

• Vaadin: from 8.0.0 through 8.12.4

References

• https://github.com/vaadin/framework/issues/12240
• https://github.com/vaadin/framework/pull/12241
• https://vaadin.com/security/cve-2021-31409
• https://github.com/vaadin/framework/issues/12240
• https://github.com/vaadin/framework/pull/12241
• https://vaadin.com/security/cve-2021-31409

Get alerted when CVE-2021-31409 or the next vulnerability affects your stack