CVE-2026-120421

A flaw was found in Eclipse Mojarra. When URL client window mode is enabled, the client window identifier parameter is appended to generated URLs without proper encoding. A remote attacker could exploit this by enticing a user to follow a malicious link, leading to reflected Cross-Site Scripting...