CVE-2026-110737

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROPACCESSCONTROLALLOWORIGINHEADER set to false and its CorsInterceptor then echoes...