CVE-2026-120421

Reflected XSS via client window id in URL client window mode

Assigner: eclipse
Reserved: 02.11.2026 Published: 04.11.2026 Updated: 04.11.2026

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 6.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Eclipse Foundation
Product	Eclipse Mojarra
Versions	Default: unaffected affected from 2.2.0 to 4.0.29 (excl.) affected from 4.1.0 to 4.1.20 (excl.) affected from 5.0.0-M1 to 5.0.0-M12 (excl.)

Vendor

Eclipse Foundation

Product

Eclipse Mojarra

Versions

Default: unaffected

affected from 2.2.0 to 4.0.29 (excl.)
affected from 4.1.0 to 4.1.20 (excl.)
affected from 5.0.0-M1 to 5.0.0-M12 (excl.)

Credits

Christian Munier reporter

References

Problem Types

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE

Impacts

CAPEC-591 Reflected XSS