Low
Security advisory
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-31406
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:40 UTC · Revision 1
Source evidence
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
osv:CVE-2021-31406
Complete source record
{
"id": "9b0da943d3efd7d16f0366d6cedbf758228fd9cb16913b563bdaf3e9f074b217",
"url": "https://osv.dev/vulnerability/CVE-2021-31406",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-31406",
"summary": "Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.",
"evidence": "osv:CVE-2021-31406",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2021-31406",
"aliases": [
"CVE-2021-31406",
"GHSA-p7jq-v8jp-j424"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/vaadin/flow",
"type": "GIT",
"events": [
{
"introduced": "4b6ca4330163c4e976b32d03880fe2154a9d1ca7"
},
{
"fixed": "b9cc454b011a504d841b53d192cf21f45a0bf829"
},
{
"introduced": "6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c"
},
{
"last_affected": "6a409a8b4b01b18dc2ca30c59395aeeb0cffbd2c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0"
},
{
"fixed": "5.0.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vaadin:flow:6.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "6.0.0-NA"
},
{
"last_affected": "6.0.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"6.0.0-NA",
"6.0.0.rc1",
"6.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31406.json",
"vanir_signatures": [
{
"id": "CVE-2021-31406-06f1b93a",
"digest": {
"length": 986,
"function_hash": "87921890465095671594157107149239927107"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "testMessageProcessing_moduleDependencyIsHandledBeforeApplyingChangesToTree"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-092d8ec8",
"digest": {
"length": 545,
"function_hash": "176435315625933838641405086351277470696"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "testForceHandleMessage_resyncIsRequested"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-34089340",
"digest": {
"threshold": 0.9,
"line_hashes": [
"1495578536536238047680867649010850752",
"33172734539250389566913900151098010676",
"231179337293411902747682902243761324027",
"185253597001049396053694317422297696389"
]
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-tests/test-root-context/src/test/java/com/vaadin/flow/uitest/ui/LogoutIT.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-3606533c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301976044352119022998234824333652301627",
"294530612798450813600507804479359823927",
"313846508660609978381643849320577681983",
"152868910803242352564842575738991795648",
"330427172926513235756074426711961637607",
"160641033736695574313842525615022396480",
"42466244212440110094325997443159500556",
"29151606416745812930228003510414829391",
"67847106582228431156213869114545086858",
"323826506804025123116176965486901768836",
"219041129912635741514384459807940989034",
"2504903256778457630835935834384938142",
"276346764895001618221222134133595690507",
"144377006106763004307837383703147829351",
"206272541706519888002747207169639770307",
"11279215192527680945869359825434536278",
"279683075942169739092847073743094260133",
"229854460136270022510002093705941719199",
"60300386956367322808909909372115483397",
"292345435704125859666852645567878440086",
"296910455200581010597901215294925009383",
"31258439730993575272104119600032343721",
"117004182896262798625874616736164890138",
"320910305921668994430000920439144976857",
"227639806535119073889189494365792253863",
"136919012888783107895999336420671234172",
"58999676969949656533042278060223553577",
"48411919721287497415317290239520976030",
"29397489976261394498168902356911749936",
"326819372456475412736501401838658181965",
"201158248422594252541353849060168407322",
"229620179222406502731970246724574755013",
"337445311431172056298910436500306497272",
"279683075942169739092847073743094260133",
"229854460136270022510002093705941719199",
"197150486713842720092809377656467335683",
"8499292696089786504678363460057021174",
"171857235048473958631861810016498461833",
"278546702569479876764925990280298716384",
"152944688506901551555408928660484152270",
"29397489976261394498168902356911749936",
"87164110531343699104921867771715297195",
"88810969644377621134850547459348925652",
"772196467971714818502189856070350282",
"238940946719695458050660680245165197075",
"247013942114101291181759859285466177970",
"229854460136270022510002093705941719199",
"155657062709356873384283097358451603287",
"81041191430164707465798982590374222389",
"103098591337564230868223973695167143035",
"13916198734395144025729590684210477321",
"256496337722683622433158801238124973043",
"271098951679845287461139650171169599984",
"302041075452351291666669545966589958874",
"125629449969682541513761705763175328136",
"318947307075254892797266499623882403630",
"142159212051806826244749516113158540711"
]
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-39b73d7a",
"digest": {
"length": 2375,
"function_hash": "254997706635657731430786788563992303816"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/main/java/com/vaadin/client/communication/MessageHandler.java",
"function": "processMessage"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-4b4a4ead",
"digest": {
"threshold": 0.9,
"line_hashes": [
"182019263383459402275143202624332887664",
"300792602988638138923883752319407317093",
"112454830199038299364027780725497257336",
"196097407916572160367510191474450910508",
"137918551173124006886329751136573497415",
"208383021895983824186477246249403638019",
"187974447530176521985074718751721039168",
"169470449152294310335055668465808383302",
"239573664339104905919818210259430252542",
"9296378964321605037383755324718051611",
"41478854613308997485435542464989583335",
"225952169907270497469411330369839556537",
"54454611844382887111544867781965506672",
"235353008800021916146450405650283607314",
"218409647827626351582692201959395962961",
"272708246323431282327688827339289434718",
"284742851407190639269583311082200681018",
"100414014369562313589808676604236918522",
"260607015884707301228257896996125954202",
"122818474809899737133917653213496603088",
"304322176576110358309378130893237370216",
"3167835482995663754065474262832190811",
"129929974916037317490963625998799622052",
"185951133179051446647755652746187811238",
"247196013788417828113488016636806666171"
]
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/main/java/com/vaadin/client/communication/MessageHandler.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-55f05674",
"digest": {
"length": 65,
"function_hash": "28348110863801476151851545095910941098"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "run"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-709bbff2",
"digest": {
"length": 354,
"function_hash": "323353777620218808128576314404020368910"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "run"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-9eb79067",
"digest": {
"length": 851,
"function_hash": "105808882375944418724014825127311336406"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "testMessageProcessing_dynamicDependencyIsHandledBeforeApplyingChangesToTree"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-bfac34cd",
"digest": {
"length": 543,
"function_hash": "225993414989184879683038962351308084324"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "gwtSetUp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-cfbe2e0b",
"digest": {
"length": 148,
"function_hash": "157977531667074534727160363062720824834"
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-client/src/test-gwt/java/com/vaadin/client/GwtMessageHandlerTest.java",
"function": "run"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31406-fa6e10a2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"62570202916061391514951174656216052849",
"30169386514352912081690429604263954546",
"62021081469409010472454182602988379095",
"176257723753143008081423279914502368121",
"118521377009206943600164791541101575177",
"270728586782767736996722050434100706180",
"256801734263702728659710510889348248621"
]
},
"source": "https://github.com/vaadin/flow/commit/b9cc454b011a504d841b53d192cf21f45a0bf829",
"target": {
"file": "flow-tests/test-root-context/src/main/java/com/vaadin/flow/uitest/ui/LogoutView.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:16:51Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/vaadin/platform",
"type": "GIT",
"events": [
{
"introduced": "354ad0186b5e61b548adad84de03af297dc6f2a6"
},
{
"fixed": "8c0a5c1db4c289feb4c766381ed9e3fe637815db"
},
{
"introduced": "5c28d4e1b9099122cf4d770283777f00a960aab3"
},
{
"last_affected": "5c28d4e1b9099122cf4d770283777f00a960aab3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.0.0"
},
{
"fixed": "18.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "19.0.0-NA"
},
{
"last_affected": "19.0.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"19.0.0-NA",
"19.0.0",
"18.0.6",
"18.0.5",
"18.0.4",
"18.0.3",
"18.0.2",
"18.0.1",
"18.0.0",
"18.0.0.rc2",
"18.0.0.rc1",
"18.0.0.beta3",
"18.0.0.beta2",
"18.0.0.beta1",
"18.0.0.alpha1",
"17.0.0",
"17.0.0.rc2",
"17.0.0.rc1",
"17.0.0.beta3",
"17.0.0.beta2",
"17.0.0.beta1",
"17.0.0.alpha7",
"17.0.0.alpha6",
"16.0.1",
"17.0.0.alpha5",
"17.0.0.alpha4",
"17.0.0.alpha3",
"17.0.0.alpha2",
"16.0.0.alpha3",
"16.0.0.alpha2",
"16.0.0.alpha1",
"15.0.0.rc1",
"15.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31406.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/vaadin/vaadin",
"type": "GIT",
"events": [
{
"introduced": "9efda1b1e0a27769eef9292dd7799d8fea77e633"
},
{
"fixed": "a4ecac5c82ecc6e1afbcd57fe3fc4e305cc232c4"
},
{
"introduced": "3981409421683b6f4a796f37b67433d36b6a7ca1"
},
{
"last_affected": "3981409421683b6f4a796f37b67433d36b6a7ca1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.0.0"
},
{
"fixed": "18.0.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "19.0.0-NA"
},
{
"last_affected": "19.0.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"19.0.0-NA",
"v19.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31406.json"
}
}
],
"modified": "2026-10-25T01:16:51.125456139Z",
"provider": "osv",
"references": [
"https://vaadin.com/security/cve-2021-31406",
"https://github.com/vaadin/flow/pull/10157"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*"
],
"vendor_product": "vaadin:vaadin",
"extracted_events": [
{
"range": [
{
"introduced": "15.0.0"
},
{
"fixed": "18.0.7"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:vaadin:vaadin:19.0.0:-:*:*:*:*:*:*"
],
"vendor_product": "vaadin:vaadin",
"extracted_events": [
{
"range": [
{
"introduced": "19.0.0-NA"
},
{
"last_affected": "19.0.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-31406",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 444453,
"published_at": "2021-04-23T16:15:08.727+00:00"
}