{"id":"CVE-2026-120421","title":"Reflected XSS via client window id in URL client window mode","summary":"In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.fa…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Eclipse Foundation","product":"Eclipse Mojarra","affected":["eclipse_mojarra >= 2.2.0 < 4.0.29","eclipse_mojarra >= 4.1.0 < 4.1.20","eclipse_mojarra >= 5.0.0-M1 < 5.0.0-M12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T18:18:42.408189Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:00:57.838Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120421","references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/536"},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/1332"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.524Z","epss":0.0021,"epssPercentile":0.1128,"slug":"CVE-2026-120421","body":"## Overview\n\nIn Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. `h:button` renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With `com.sun.faces.enableCspNonce=true`, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.\n\n## Affected\n\n- `eclipse_mojarra >= 2.2.0 < 4.0.29`\n- `eclipse_mojarra >= 4.1.0 < 4.1.20`\n- `eclipse_mojarra >= 5.0.0-M1 < 5.0.0-M12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}