CVE-2021-26296: Cryptographically weak CSRF tokens in Apache MyFaces
Summary
CVE-2021-26296: Cryptographically weak CSRF tokens in Apache MyFaces. Affects org.apache.myfaces.core:myfaces-core-module across 4 version ranges.
< 2.0.25
>= 2.1.0, < 2.1.19
>= 2.2.0, < 2.2.14
>= 2.3.0, < 2.3.8
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache MyFaces is a Java-based web application framework used for building user interfaces for JavaServer Faces (JSF) applications. It provides a set of reusable UI components and a robust framework for managing the UI state. MyFaces Core is the main module of Apache MyFaces, responsible for the core functionality of the framework. This vulnerability affects versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 of MyFaces Core.
Vulnerability Detail
The default configuration of Apache MyFaces Core uses cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. This limitation allows an attacker, although difficult, to calculate a future CSRF token value and trick a user into executing unwanted actions on an application. CSRF attacks can lead to unauthorized actions, data breaches, and other security vulnerabilities.
How To Fix
Latest published version: 4.1.4 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.252.0.25 -
>= 2.1.0, < 2.1.192.1.19 -
>= 2.2.0, < 2.2.142.2.14 -
>= 2.3.0, < 2.3.82.3.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 allows for cryptographically weak CSRF tokens, which can be exploited by attackers to trick users into executing unwanted actions. It is recommended to update to the fixed versions and modify the web.xml configuration parameters to enhance CSRF token security. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.myfaces.core:myfaces-core-module →
FAQ
Apache MyFaces is a Java-based web application framework used for building user interfaces for JavaServer Faces (JSF) applications.
A CSRF token is a security measure used to protect against cross-site request forgery attacks. It is a unique token generated for each user session and included in requests to verify the authenticity of the request.
CSRF attacks can lead to unauthorized actions, data breaches, and other security vulnerabilities. Attackers can manipulate user actions, perform actions on behalf of the user, or gain access to sensitive information.
To update Apache MyFaces Core, you can use a dependency management tool like Maven or manually download the latest version from the Apache MyFaces website.
There is no known exploit available for this vulnerability at the time of this advisory.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.myfaces.core:myfaces-core-module.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
