A vulnerability in the Vaadin Maven and Gradle plugins causes the full set of environment variables to be written to build logs whenever the frontend build process fails. Because build environments often contain sensitive credentials supplied as environment secrets, a failed frontend build can expose those secrets to anyone with access to the CI logs or archived artifacts. The flaw is an information exposure weakness (CWE‑209).

The issue affects Vaadin Flow plugins for versions 23.0.0 through 25.1.4. Specifically, the Vaadin Flow Plugin Base, Vaadin Flow Maven Plugin, and Vaadin Flow Gradle Plugin are vulnerable. The vulnerable ranges are 23.0.0‑23.6.9, 24.0.0‑24.10.3, and 25.0.0‑25.1.4; the problem is fixed starting at 23.6.10, 24.10.4, and 25.1.5 respectively, which are supported releases.

The CVSS score is 1.6, indicating a very low severity from a technical standpoint. EPSS data is not available, and the CVE is not listed in CISA’s KEV catalog, suggesting limited commercial exploitation. However, the attack vector is likely internal or during use of continuous integration pipelines, where build failures could inadvertently leak sensitive data to build log viewers. The vulnerability requires a failed frontend build to trigger the log write, so an attacker would need to induce a build failure or already have access to logs of a failed build.