CVE-2026-120421 · Package
NO FIX YET · SEE WHAT TO DO
When URL client window mode is enabled, Eclipse Mojarra appends the jfwid or jakarta.faces.ClientWindow request parameter to generated URLs without encoding it, and h:button renders that value into a JavaScript string. An attacker can lure a user to a crafted link that runs script in the victim's browser, and with CSP nonces enabled the script can bypass the Content Security Policy.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use Eclipse Mojarra as their JavaServer Faces implementation and have URL client window mode turned on, since only that mode appends the client window id to URLs. Applications on the default client window mode, or on versions outside the listed ranges, are not exposed by this flaw.
Not affected if default-config, outside-affected-versions
Who cares jakarta-faces, java, jsf, mojarra
jakarta.faces.CLIENT_WINDOW_MODE is set to url in web.xml or the application configurationcom.sun.faces.enableCspNonce is set to trueIn Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With , the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.
com.sun.faces.enableCspNonce=trueThis page as .md · .json · in your agent: get_signal("CVE-2026-120421") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.