{"id":"CVE-2026-120421","kind":"vulnerability","aliases":["CVE-2026-120421"],"related":[],"title":"Eclipse Mojarra: unencoded client window id enables reflected cross-site scripting","description":"In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.","summary":"When URL client window mode is enabled, Eclipse Mojarra appends the jfwid or jakarta.faces.ClientWindow request parameter to generated URLs without encoding it, and h:button renders that value into a JavaScript string. An attacker can lure a user to a crafted link that runs script in the victim's browser, and with CSP nonces enabled the script can bypass the Content Security Policy.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jakarta-faces","java","jsf","mojarra","package"],"not_affected_if":["default-config","outside-affected-versions"],"how_to_check":"- Check whether `jakarta.faces.CLIENT_WINDOW_MODE` is set to `url` in `web.xml` or the application configuration\n- Check whether `com.sun.faces.enableCspNonce` is set to `true`\n- Check the Mojarra version in the project dependencies against the affected ranges (2.2.0 through 4.0.28, 4.1.0 through 4.1.19, 5.0.0-M1 through 5.0.0-M11)","fix":"- Upgrade Mojarra to a release newer than the affected ranges (2.2.0 to 4.0.28, 4.1.0 to 4.1.19, 5.0.0-M1 to 5.0.0-M11); the fixed version numbers are unknown from the sources","status":"open","published_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","triaged_at":"2026-11-04T15:28:26+00:00","updated_at":"2026-11-04T15:28:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T15:28:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Mojarra to a release newer than the affected ranges (2.2.0 to 4.0.28, 4.1.0 to 4.1.19, 5.0.0-M1 to 5.0.0-M11); the fixed version numbers are unknown from the sources","reach":"internet","title":"Eclipse Mojarra: unencoded client window id enables reflected cross-site scripting","impact":"medium","summary":"When URL client window mode is enabled, Eclipse Mojarra appends the jfwid or jakarta.faces.ClientWindow request parameter to generated URLs without encoding it, and h:button renders that value into a JavaScript string. An attacker can lure a user to a crafted link that runs script in the victim's browser, and with CSP nonces enabled the script can bypass the Content Security Policy.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","jsf","mojarra","jakarta-faces"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in victim browsers, bypassing CSP","analyst_note":"Confirm the fixed Mojarra versions for each affected branch from the Eclipse advisory or NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-120421).","how_to_check":"- Check whether `jakarta.faces.CLIENT_WINDOW_MODE` is set to `url` in `web.xml` or the application configuration\n- Check whether `com.sun.faces.enableCspNonce` is set to `true`\n- Check the Mojarra version in the project dependencies against the affected ranges (2.2.0 through 4.0.28, 4.1.0 through 4.1.19, 5.0.0-M1 through 5.0.0-M11)","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","outside-affected-versions"],"who_is_affected":"Applications that use Eclipse Mojarra as their JavaServer Faces implementation and have URL client window mode turned on, since only that mode appends the client window id to URLs. Applications on the default client window mode, or on versions outside the listed ranges, are not exposed by this flaw.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00083,"input_tokens":4300,"output_tokens":800,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120421':15A,18A '-2026':14A,17A '2.2.0':93C '4.0.28':95C '4.1.0':96C '4.1.19':98C '5.0.0':100C,103C 'allow':148C 'append':35B,128C 'attack':59B 'browser':75B 'button':50B,137C 'bypass':84B,169C 'client':4A,28B,107C,117C 'com.sun.faces.enablecspnonce':155C 'content':86B,171C 'craft':66B 'cross':10A,151C 'cross-sit':9A,150C 'csp':78B 'cve':13A,16A 'eclips':1A,33B,90C 'element':168C 'enabl':7A,32B,80B,111C 'encod':46B,135C 'face':21B 'generat':43B,130C 'h':49B,136C 'id':6A,119C 'inject':158C 'insid':164C 'jakarta':20B 'jakarta-fac':19B 'jakarta.faces.client':112C 'jakarta.faces.clientwindow':39B,124C 'java':22B 'javascript':56B,144C 'jfwid':37B,122C 'jsf':23B 'link':67B 'liter':146C 'load':163C 'lure':61B 'm1':101C 'm11':104C 'mode':30B,109C,114C 'mojarra':2A,24B,34B,91C 'nonc':79B,166C 'packag':25B 'page':162C 'paramet':41B,126C 'polici':88B,173C 'reflect':8A,149C 'render':51B,138C 'request':40B,125C 'run':69B,160C 'script':12A,70B,82B,153C,159C,167C 'secur':87B,172C 'site':11A,152C 'string':57B,145C 'true':156C 'unencod':3A 'url':27B,44B,106C,115C,131C,134C,141C 'url-encod':133C 'user':63B 'valu':53B 'version':92C 'victim':73B 'window':5A,29B,108C,113C,118C 'without':45B,132C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Eclipse Mojarra as their JavaServer Faces implementation and have URL client window mode turned on, since only that mode appends the client window id to URLs. Applications on the default client window mode, or on versions outside the listed ranges, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jakartafaces","java","jsf","medium","mojarra","package"],"campaign_type":null,"first_public_at":"2026-11-04T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120421","severity":null,"published_at":"2026-11-04T15:17:41+00:00","modified_at":"2026-11-04T15:17:41+00:00","first_seen_at":"2026-11-04T15:27:29+00:00","fetched_at":"2026-11-04T15:27:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}