CVE-2021-31408

    Dashboard / Vulnerabilities / CVE-2021-31408

    CVE-2021-31408

    Published: 23 Apr 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

    References: https://vaadin.com/security/cve-2021-31408, https://github.com/vaadin/flow/pull/10577

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 60b4fd8e59948e2a6a5f8af1988a3adc45563ffc
    Fixed -6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c

    Affected versions

    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0.rc1
    6.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-31408 | CVE-DB