CVE-2026-120421
Received Received - Intake

Reflected XSS in Eclipse Mojarra via Client Window Parameter

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Eclipse Foundation

Description
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-120421
EUVD
EUVD-2026-116938

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Eclipse Mojarra, a Jakarta Faces implementation. When URL client window mode is enabled, the client window ID from the jfwid parameter or jakarta.faces.ClientWindow header is appended to generated URLs without proper URL encoding. The h:button component renders this URL into a JavaScript string literal, allowing attackers to inject malicious scripts.

Detection Guidance

To detect this vulnerability, check if your Eclipse Mojarra application uses URL client window mode (jakarta.faces.CLIENT_WINDOW_MODE=url) and renders h:button components with outcomes. Inspect server logs for requests containing jfwid or jakarta.faces.ClientWindow parameters with suspicious payloads. Test by crafting URLs with malicious scripts in these parameters and observe if they execute.

Impact Analysis

An attacker can craft a URL with a malicious payload in the jfwid parameter. When a victim accesses the URL and interacts with the button, the injected script executes within the application's trusted origin. This enables session hijacking, data theft, or phishing attacks. Even with CSP nonces enabled, the script bypasses protections by running in a valid nonce-protected element.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected Mojarra versions may face compliance violations if exploited.

Mitigation Strategies

Disable URL client window mode by setting jakarta.faces.CLIENT_WINDOW_MODE to 'none' or 'client'. Validate jfwid and jakarta.faces.ClientWindow parameters to ensure they match expected formats. Avoid using h:button with outcome on affected pages. Update to a patched Mojarra version once available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...