Timing Side Channel Vulnerability in Vaadin Endpoint Request Handler
Summary
GHSA-9h6g-6mxg-vvp4: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19. Affects com.vaadin:vaadin-bom across 2 version ranges.
>= 15.0.0, < 18.0.7
>= 19.0.0, < 19.0.1
Fixed in 18.0.7 or 19.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces. The Vaadin framework includes the com.vaadin:flow-server library, which handles endpoint requests and manages security tokens. However, versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6) of com.vaadin:flow-server and version 6.0.0 (Vaadin 19.0.0) of com.vaadin:fusion-endpoint are vulnerable to a timing side channel attack.
Vulnerability Detail
The vulnerability arises from a non-constant-time comparison of CSRF tokens in the endpoint request handler. An attacker can exploit this vulnerability to guess a security token for Fusion endpoints using a timing attack. By measuring the time taken for different token comparisons, an attacker can deduce the correct token and potentially bypass the CSRF protection mechanism. This can lead to unauthorized access, data leakage, or other security breaches.
How To Fix
Latest published version: 25.3.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 15.0.0, < 18.0.718.0.7 -
>= 19.0.0, < 19.0.119.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround is to disable Fusion endpoints or implement additional security measures to mitigate the risk of CSRF attacks. This can include enforcing strict access controls, implementing strong session management, and using additional CSRF protection mechanisms.
Conclusion
The timing side channel vulnerability in the endpoint request handler of Vaadin versions 15-19 can be exploited by an attacker to guess security tokens for Fusion endpoints. It is crucial to upgrade to the fixed versions of the affected libraries or implement appropriate security measures to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
Vaadin is an open-source Java framework for building web applications with a rich user interface.
A timing side channel attack is a type of attack that exploits variations in the time taken to perform certain operations to deduce sensitive information.
A CSRF token is a security measure used to protect against Cross-Site Request Forgery (CSRF) attacks. It is a unique token generated for each user session and included in requests to verify the authenticity of the request.
Fusion endpoints are a feature of Vaadin Fusion, a framework for building web applications with a Java backend and a JavaScript frontend. Fusion endpoints allow communication between the backend and frontend components.
This vulnerability can potentially allow an attacker to bypass CSRF protection and gain unauthorized access to sensitive data or perform actions on behalf of authenticated users.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
