Eclipse Mojarra 2.2-5.0.0-M11: Reflected XSS via unencoded URL client window ID (CSP bypass)
CVE-2026-120421 Published on November 4, 2026
Reflected XSS via client window id in URL client window mode
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.
Vulnerability Analysis
CVE-2026-120421 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-120421 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-120421
Want to know whenever a new CVE is published for Eclipse Mojarra? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Mojarra:- Version 2.2.0 and below 4.0.29 is affected.
- Version 4.1.0 and below 4.1.20 is affected.
- Version 5.0.0-M1 and below 5.0.0-M12 is affected.