VYPR
← All advisories
Medium severity4.0NVD Advisory· Published Apr 23, 2021· Updated Jun 17, 2026

CVE-2021-31406

CVE-2021-31406

Description

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.vaadin:flow-serverMaven
>= 3.0.0, < 5.0.45.0.4
com.vaadin:flow-serverMaven
>= 6.0.0, < 6.0.16.0.1

Affected products

7
  • Vaadin/Flow2 versions
    cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*range: >=3.0.0,<5.0.4
    • cpe:2.3:a:vaadin:flow:6.0.0:-:*:*:*:*:*:*
  • Vaadin/Vaadin3 versions
    cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*range: >=15.0.0,<18.0.7
    • cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:*
    • (no CPE)range: 19.0.0
  • ghsa-coords
    pkg:maven/com.vaadin/flow-server
    Range: >= 3.0.0, < 5.0.4
  • Vaadin/flow-servercpe-rescue
    Range: 6.0.0

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.