An authentication bypass flaw allows unauthenticated users to trigger framework initialization by accessing the /VAADIN endpoint without a trailing slash. This bypass permits the creation of HTTP sessions without proper authorization, exposing the application to unauthorized access for session establishment and potentially sensitive data exposure. The weakness is rooted in improper privilege management (CWE-284) and path handling inconsistencies (CWE-551). The result is that any actor who can reach the vulnerable URL can obtain a session token and subsequently use that session for further interactions without needing valid credentials.

Vaadin Flow 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7, and 25.0.0 through 25.0.1 are affected when Spring Security is in use. Versions 10-13 and 15-22 are no longer supported and should be upgraded to the latest 14, 23, 24, or 25 series. The effect targets applications configured to serve the /VAADIN path as a reserved framework route.

The CVSS base score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation as of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this through normal web requests to the /VAADIN endpoint without a slash, creating a session without authentication. No additional credentials or system privileges are required beyond network connectivity to the application.