CVE-2021-31408: Server session not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Summary
CVE-2021-31408: Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Sec... Affects com.vaadin:vaadin-bom versions >= 18.0.0, < 19.0.4. Fixed in 19.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.vaadin:vaadin-bom package is an open-source library for building web applications using the Vaadin framework. It provides a set of components and tools to create modern and responsive user interfaces. The package is widely used in Java-based web development projects.
Vulnerability Detail
The Authentication.logout() helper method in the com.vaadin:flow-client library versions 5.0.0 prior to 6.0.0 (Vaadin 18) and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) has a vulnerability that allows local attackers to access Fusion endpoints after a user attempts to log out. This vulnerability arises from the incorrect HTTP method used by the logout() method, which, when combined with Spring Security CSRF protection, bypasses the intended session invalidation. As a result, an attacker with local access can exploit this vulnerability to gain unauthorized access to Fusion endpoints and potentially perform malicious actions.
How To Fix
Latest published version: 25.3.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
19.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually invalidate the session after calling the logout() method. This can be done by obtaining the current session object and calling its invalidate() method. Here is an example of how to implement this workaround in Java:
import com.vaadin.flow.server.VaadinSession;
// Call this method after calling Authentication.logout()
public void invalidateSession() {
VaadinSession.getCurrent().getSession().invalidate();
}
Conclusion
The com.vaadin:flow-client library versions 5.0.0 prior to 6.0.0 (Vaadin 18) and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) have a vulnerability that allows local attackers to access Fusion endpoints after a user attempts to log out. Developers using these versions should upgrade to version 6.0.4 or later to mitigate the risk. In the meantime, a temporary workaround is available by manually invalidating the session after calling the logout() method. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
This vulnerability allows local attackers to access Fusion endpoints even after a user has logged out. This can lead to unauthorized access to sensitive data or the ability to perform malicious actions on the affected system.
The vulnerability affects versions 5.0.0 prior to 6.0.0 (Vaadin 18) and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) of the com.vaadin:flow-client library.
Yes, the vulnerability can be fixed by upgrading to version 6.0.4 or later of the com.vaadin:flow-client library.
No, this vulnerability can only be exploited by local attackers who have access to the affected system.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
