Vulnerability · Published Nov 4, 2026 · Assigned by eclipse
CVE-2026-120421Reflected XSS via client window id in URL client window mode
Medium 6.1
In plain English
A medium-severity cross-site scripting in Eclipse Mojarra from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mojarra | no fix listed | DEBIAN-CVE-2026-120421 |
| Debian:13 | mojarra | no fix listed | DEBIAN-CVE-2026-120421 |
| Debian:14 | mojarra | no fix listed | DEBIAN-CVE-2026-120421 |
| Ubuntu:22.04:LTS | mojarra | no fix listed | UBUNTU-CVE-2026-120421 |
| Ubuntu:24.04:LTS | mojarra | no fix listed | UBUNTU-CVE-2026-120421 |
| Ubuntu:26.04:LTS | mojarra | no fix listed | UBUNTU-CVE-2026-120421 |
| Ubuntu:26.10 | mojarra | no fix listed | UBUNTU-CVE-2026-120421 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Eclipse Mojarra | 2.2.0 – before 4.0.294.1.0 – before 4.1.205.0.0-M1 – before 5.0.0-M12 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N