CVE-2021-31406: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

The vulnerability stems from non-constant-time comparisons of security tokens using String.equals(). All four functions were explicitly modified across multiple commits to replace equals() with MessageDigest.isEqual(), as shown in the patch diffs. These functions directly handle security-critical token comparisons (CSRF tokens, push IDs, upload security keys) and their pre-patch implementations would appear in runtime profiles during token validation when an attacker sends malicious requests. The confidence is high because the patch evidence directly shows insecure comparisons being replaced with constant-time equivalents in security-sensitive contexts.