Reflected Cross-Site Scripting in Eclipse Mojarra Before 5.0.0-M12

CVE-2026-120421

What is CVE-2026-120421?

In specific versions of Eclipse Mojarra, enabling the URL client window mode allows for the appending of client window IDs to generated URLs without proper URL-encoding. This oversight can lead to reflected cross-site scripting vulnerabilities, where malicious scripts can be injected and executed in the context of the user's browser. When configured with a CSP nonce, these scripts can evade standard content security measures, posing a significant risk to web application security.

References