Is CVE-2026-120421 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120421 being exploited in the wild.

How severe is CVE-2026-120421?

Medium severity, with a CVSS score of 6.1, published 4 November 2026.

Which products and versions are affected?

Eclipse Mojarra 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, 5.0.0-M1 through 5.0.0-M11.

How is CVE-2026-120421 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120421?

Check whether you run Eclipse Mojarra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120421: Eclipse Mojarra reflected XSS in URL client window mode

CVE-2026-120421 · Severity: medium · CVSS 6.1 · Published 2026-11-04

Eclipse Mojarra is a Java framework for building web applications. When URL client window mode is enabled and `h:button` components are used, an attacker can inject malicious JavaScript through a crafted URL parameter. The injected script runs in the victim's browser when they click the button, allowing session hijacking, credential theft, or malware distribution.

Vendors: Eclipse.

Quick answers

Is CVE-2026-120421 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120421 being exploited in the wild.
How severe is CVE-2026-120421?: Medium severity, with a CVSS score of 6.1, published 4 November 2026.
Which products and versions are affected?: Eclipse Mojarra 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, 5.0.0-M1 through 5.0.0-M11.
Is there a fix for CVE-2026-120421?: Yes: fixed in 4.0.29, 4.1.20, 5.0.0-M12. Until then: Do not enable URL client window mode (keep `jakarta.faces.CLIENT_WINDOW_MODE` at its default `none`). Alternatively, validate the `jfwid` and `jakarta.faces.ClientWindow` parameters using a servlet filter or reverse proxy with a character whitelist such as `[A-Za-z0-9_:.-]`, or replace `h:button` with `h:link` on affected pages.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-04"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120421 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120421?: Check whether you run Eclipse Mojarra at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.29, 4.1.20, 5.0.0-M12

Do not enable URL client window mode (keep `jakarta.faces.CLIENT_WINDOW_MODE` at its default `none`). Alternatively, validate the `jfwid` and `jakarta.faces.ClientWindow` parameters using a servlet filter or reverse proxy with a character whitelist such as `[A-Za-z0-9_:.-]`, or replace `h:button` with `h:link` on affected pages.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-11-04"}]

Technical details

The vulnerability is a reflected cross-site scripting (CWE-79) in the client window ID parameter handling. When URL client window mode is active, the `jfwid` or `jakarta.faces.ClientWindow` request parameter is appended to generated URLs without URL-encoding. The `h:button` renderer then includes this URL in a JavaScript string literal without escaping, allowing JavaScript injection. With CSP nonce enabled, the injected script executes on page load inside the nonce-protected script element, bypassing Content Security Policy protections.

Affected products

Eclipse Mojarra 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, 5.0.0-M1 through 5.0.0-M11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.