CVE-2021-26296
Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
- Record
CVE-2021-26296- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
- Record
CVE-2021-26296- Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2021-1329
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
- Record
EUVD-2021-1329- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gq67-pp9w-43gp No score
Cryptographically weak CSRF tokens in Apache MyFaces
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:
org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
- Record
GHSA-gq67-pp9w-43gp- Weakness
- CWE-330, CWE-352
- Updated
- 2026-11-02
OSV
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
- Record
CVE-2021-26296- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gq67-pp9w-43gp No score
Cryptographically weak CSRF tokens in Apache MyFaces
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
Mitigation: Existing web.xml configuration parameters can be used to direct MyFaces to use SecureRandom for CSRF token generation:
org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
- Record
GHSA-gq67-pp9w-43gp- Weakness
- CWE-330, CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.myfaces.core:myfaces-core-moduleMaven |
before 2.0.25 | 2.0.25 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.1.0 up to 2.1.19 | 2.1.19 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.2.0 up to 2.2.14 | 2.2.14 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.3.0 up to 2.3.8 | 2.3.8 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
before 2.0.25, plus listed versions 2.0.132.0.142.0.152.0.162.0.17 Show 7 moreShow less2.0.182.0.192.0.202.0.212.0.222.0.232.0.24 |
2.0.25 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.1.0 up to 2.1.19, plus listed versions 2.1.102.1.112.1.122.1.132.1.14 Show 7 moreShow less2.1.152.1.162.1.172.1.182.1.72.1.82.1.9 |
2.1.19 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.2.0 up to 2.2.14, plus listed versions 2.2.12.2.102.2.112.2.122.2.13 Show 8 moreShow less2.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.9 |
2.2.14 |
org.apache.myfaces.core:myfaces-core-moduleMaven |
2.3.0 up to 2.3.8, plus listed versions 2.3-next-M12.3-next-M22.3-next-M32.3-next-M42.3-next-M5 Show 11 moreShow less2.3-next-M62.3-next-M72.3-next-M82.3-next-M92.3.12.3.22.3.32.3.42.3.52.3.62.3.7 |
2.3.8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-26296 is a high vulnerability (CVSS 7.5) in Apache Myfaces, published February 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.89%, the 86th percentile. Fixed in org.apache.myfaces.core:myfaces-core-module 2.0.25.
References
lists.apache.org/thread.html/r2b73e2356c6155e9ec78fdd8f72a4fac12f3e588014f5f535106ed9b%40%3Cannounce.apache.org%3E
seclists.org/fulldisclosure/2021/Feb/66
packetstormsecurity.com/files/161484/Apache-MyFaces-2.x-Cross-Site-Request-Forgery.html
security.netapp.com/advisory/ntap-20210528-0007
nvd.nist.gov/vuln/detail/CVE-2021-26296
github.com/apache/myfaces/commit/cc6e1cc7b9aa17e52452f7f2657b3af9c421b2b2
issues.apache.org/jira/browse/MYFACES-4373