CVE-2026-120421

In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled jakarta.faces.CLIENTWINDOWMODE=url, the client window id from the jfwid or jakarta.faces.ClientWindow request parameter is appended to generated URLs...