CVE-2026-120421: Reflected XSS via client window id in URL client window mode
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENTWINDOWMODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the affected Eclipse Mojarra versions are exposed when URL client window mode is enabled with jakarta.faces.CLIENT_WINDOW_MODE=url and pages render h:button components. The issue is reachable through the jfwid or jakarta.faces.ClientWindow request parameter.
What must an attacker do to exploit it?
An attacker needs to cause a user to visit a crafted URL containing a malicious client window ID parameter. No attacker privileges are required, but user interaction is required.
Does enabling CSP prevent exploitation?
Not when com.sun.faces.enableCspNonce=true. In that configuration, the injected script runs on page load within the nonce-bearing script element and bypasses the Content Security Policy.
What can be done if upgrading is not immediately possible?
Disable URL client window mode by avoiding the jakarta.faces.CLIENT_WINDOW_MODE=url configuration. This removes the stated condition under which the unencoded client window ID is appended to generated URLs.
How can I determine whether an application is affected?
Check whether the deployed Eclipse Mojarra version falls within 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, or 5.0.0-M1 through 5.0.0-M11. Also verify whether jakarta.faces.CLIENT_WINDOW_MODE is set to url and whether affected pages use h:button.