CVE-2026-120421

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (jakarta.faces.CLIENT_WINDOW_MODE=url), the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs without URL-encoding. h:button renders such a URL into a JavaScript string literal, which allows reflected cross-site scripting. With com.sun.faces.enableCspNonce=true, the injected script runs on page load inside the nonce script element, bypassing the Content Security Policy.